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From: Samantha Whitley <cgganalyst2 @gmail.com> 

Sent: Wednesday, October 7, 2020 9:11 AM 

To: elections@lowndescounty.com; elections@lumpkincounty.gov; tdean@mcelections.us; Marion 
County Elections & Registrations <marioncountyelect@gmail.com>; Phyllis Wheeler 

<Phyllis. Wheeler3 @thomson-mcduffie.net>; Doll Gale <egale@darientel.net>; Patty Threadgill 
<p.threadgill@meriwethercountyga.gov>; Jerry C <registrars@millercountyga.com>; Terry Ross 
<tross@mitchellcountyga.net>; Kaye Warren <kwarren@monroecoga.org>; rmoxsand@hotmail.com; 
Jennifer Doran <jdoran@morgancountyga.gov>; vote@murraycountyga.gov; Nancy Boren 
<nboren@columbusga.org>; Angela Mantle <amantle@co.newton.ga.us>; Fran Leathers 
<fleathers@oconee.ga.us>; Steve McCannon <smccannon@oglethorpecountyga.gov>; Deidre Holden 
<deidre.holden@paulding.gov>; Adrienne Ray <adrienne-ray@peachcounty.net>; Julie Roberts 
<jroberts@pickenscountyga.gov>; Leah Williamson <leah.williamson@piercecountyga.gov>; Sandi 
Chamblin <schamblin@pikecoga.com>; Lee Ann George <lgeorge@polkga.org>; quit.judge@gqc-ga.org; 
twhitmire@rabuncounty.ga.gov; Todd Black <rcc.boe@gmail.com>; Lynn Bailey 
<lbailey@augustaga.gov>; cynthia.welch@rockdalecountyga.gov; Schley Registrars 

<registrars schley@yahoo.com> 


Subject: Followup - new unsealed documents and response to Harvey bulletin 


Providing the Facts—BMD Security Risks and Software Update 


The events of the last 11 days have made it clearer than ever that county election 
officials have the duty to abandon the county-wide use of BMD touchscreen machines 
and adopt hand marked paper ballots because the BMD units cannot be used securely 
or legally---certainly making their deployment “impossible,” “impractical” or “unusable.” 
[Those are the conditions in the statute and new election rule that call for the 
superintendent’s decision to use hand marked paper ballots.] We offer more facts as 


your board makes this significant decision. 


The 2020 General Election is underway, and last week the Secretary of State ordered 
election officials across the state to erase the original certified software from 34,000 
Ballot Marking Devices and install new software, which was uncertified and untested. 


Channel 11 in Atlanta featured the issue tonight. (https://youtu.be/IMJU2p4_LDM) We 
are aware that several other reporters are trying to get answers as well, without 
SUCCESS. 
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Yesterday the Court unsealed critical information about the voting system changes, 
which is important for election officials to read. Meantime, the State is pressuring county 
officials to comply with their instructions, without considering the consequences. 


On Monday Chris Harvey issued a bulletin titled, “Be Wary of False and Misleading 
Information re: ICX Update” 


The extra capitalization probably tipped you off to be wary of what was to follow. 


If you’ve read many of the Court documents in our Curling v. Raffensperger case, you'll 
be familiar with the pattern: Coalition for Good Governance presents testimony from the 
nation’s most respected expert witnesses, evidence, science, law, and facts. State 
responds with hyperbole and unsubstantiated claims, and sometimes name-calling. 


The State is attempting to force you into a difficult choice —to follow their orders, and 
trust that nothing goes wrong, or to use your authority do follow what the statutes and 
election rules require, risking retribution from the State Election Board. It comes down to 
this - use the un-auditable BMDs with altered software, or use ballots marked by pen for 
in-person voting. 


The experts confirm that installing hastily written software on the eve of in-person voting 
is akin to redesigning an aspect of an airplane as it is about to take off. 


Here’s what's wrong with assertions made in the Monday’s Bulletin from Chris Harvey: 


Fact: EAC certification requires pre-approval of de minimis changes before they are 
implemented. The vendor declaring software error-correcting changes “de minimis” 
does not make it so. When you received the new software on Sept 30, with, instructions 
to immediately wipe your BMDs clean and install it, the test lab had NOT issued its 
report (dated Oct 2) and Dominion had not submitted the proposed “de minimis” change 
to the EAC. We can find no evidence that the proposed change has been submitted to 
the EAC for certification, despite the Secretary's commitment to the Court that it had 
been done. 


Case 2:20 a8e1B124c1. 02 S8S\WT EDBcNmeéntlL85 Pag ee CD60/E9RD 1 Pa5e4 oPAagé 4 of 119 


Fact: the lab that tested the software change did not test to be sure it did not “cause any 
other issues with the operation of the ICX.” 


Fact: When you were asked to install the software on 9/30, the updated version of the 
ICX touchscreen software (version 5.5.10.32) was NOT certified by the Secretary of 
State. It was technically certified (but without conducting the mandated prerequisite 
tests) yesterday, October 5. This is risk for your voters and their candidates that the 
county boards simply cannot tolerate. 


Fact: The Secretary made no mention that state law requires counties to conduct 
acceptance testing after installing modified software, and before installing the November 
programming and conducting LAT, leaving the counties to deal with the consequences 
of the failure to do so. 


With regards to the shocking assertion that the Secretary of State helped draft an 
intended loophole in the law to make required EAC system certification meaningless — it 
boggles the imagination. He claims that while the General Assembly ordered that only 
EAC software be purchased, he can change it behind closed doors to do whatever he 
wants. The Secretary is shamelessly defending his “election security be damned” 
policies, despite the his disingenuous “Secure the Vote” logo. 


Don't take our word for any of this. The transcript of the October 1 court conference was 
just unsealed, along with new declarations from experts Alex Halderman, Kevin 
Skoglund, and Harri Hursti, plus the Pro V&V test lab letter. We attached them for 
you to read the grave concerns of the nationally respected experts along with 
the transcript from the sealed proceedings. The State has been unable to 
engage experts who support their use of BMDs or this software. Instead they 
only have (often inaccurate) testimony from vendors. 


The SOS wants you to bet your voters’ ballots, and your counties’ candidates’ 
campaigns, on the high-risk notion that the software change solves the original problem, 
with no unintended consequences, including the introduction of more errors or malware. 
Also he wants you to bet that losing candidates won’t challenge the election on the 
basis of the host of BMD risks, problems and legal non-compliance from ballot secrecy 
to failing software that may well hide its defects. 
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The experts are clear: if you use the altered BMDs, your elections will not be 
defensible. 


The only sound choice is to draw a line in the sand and strictly comply with the law. The 
law holds the County Superintendent responsible for the conduct of elections. And when 
things go wrong, and the lawsuits come, the Secretary of State will blame the counties. 


The November 2020 election is consequential. All eyes are on election administrators. 
And on Georgia. We urge you to put voters first, set aside the problematic BMDs, and 
use ballots marked by pen for in-person voting as authorized by O.C.G.A 21-2-281 and 
SEB Rule 183-1-12-.11(2)(c)-(d)—the only legal path before you for conducting an 
accountable and constitutionally compliant election. 


As always, we are happy to hear from you to discuss this further. 


Marilyn Marks 
Executive Director 
Coalition for Good Governance 


Marilyn@USCGG.org 
704 292 9802 


Samantha Whitley 
Research Analyst 
Coalition for Good Governance 


Cell: 704 763 8106 


HaG26 oPAge 6 of 119 








Case 2:20 a8e1B8124c1.W2 F8S\WT EDBcNmeéntlL85 Pag eHieCD90/E9RD 1 Pa5ed oPAagEe 7 of 119 


Exhibit A 


Case 2:20.a8e1B8134cUWR FSWT EDEcNMmentl85 Pag ede 00/G9R01 Pa5eS oP age 8 of 119 





OFFICIAL ELECTION BULLETIN 
October 5, 2020 


TO: County Election Officials and County Registrars 
FROM: Chris Harvey, Elections Division Director 
RE: Be Wary of False and Misleading Information re: ICX Update 


You may have received correspondence today from activists for hand-marked paper 
ballots and their attorney. These activists have been suing the state and Georgia counties 
for years because they disagree with the decision of the Georgia General Assembly to 
use electronic ballot-marking devices instead of hand-marked paper ballots. Because 
their preferred policy was not enacted, they have tried to force their preferred policy on 
the state through litigation. The latest correspondence makes false and misleading 
allegations regarding the recent update to the ICX (touchscreen) component of Georgia’s 
voting system. 


As you know, an issue was discovered during Logic and Accuracy testing that, in certain 
rare circumstances, caused the second column of candidates in the U.S. Senate Special 
Election to not correctly display on the touchscreen. The issue was caught prior to any in- 
person voting due to excellent L&A testing by county election officials. Soon after the 
issue was brought to our attention, Dominion diagnosed the issue and began to work on 
a solution. 


Dominion’s solution required a de minimis software update to the touchscreen. That 
update was tested at Dominion, tested again at the state’s EAC-certified test lab, and 
tested again at the Center for Election Systems to determine that it resolved the display 
issue and did not cause any other issues with the operation of the ICX. The state only 
distributed the update after verifying the test results with the EAC-certified test lab and 
acceptance testing the update at CES prior to distribution to counties. This is the normal 
process to follow for a state certification update. The updated version of the ICX 
touchscreen software (Version 5.5.10.32) has been certified by the Secretary of State as 
safe for use in Georgia’s elections. You should continue to install the update as instructed 
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by CES. You should also confirm both the confidential hash value and the version number 
on each ICX BMD touchscreen during L&A testing. 


The correspondence you may have received today also misstates Georgia law when it 
says that the update has to first be certified by the EAC. Georgia law required the initial 
system procured to be EAC certified, but it does not require that all updates first be 
certified by the EAC. The law was drafted that way intentionally, with input from our office, 
to ensure that the state did not have to wait on the EAC when important updates were 
needed.' Even with these provisions of Georgia law, Dominion advises that it has already 
submitted the update to the EAC for approval as a de minimis change, as recommended 
by the EAC-certified test lab. 


Thank you to the counties whose diligent L&A testing allowed this issue to be identified 
and resolved quickly. And thank you to all county election officials for your continued hard 
work in this difficult year for election administration. 


1 You probably remember that the EAC was without a quorum for two years, and therefore unable to take any 
action. 
Page 2 of 2 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE NORTHERN DISTRICT OF GEORGIA 





ATLANTA DIVISION 
DONNA CURLING, ET AL., 
Plaintiffs, 
DECLARATION OF 
V. J. ALEX HALDERMAN 


BRAD RAFFENSPERGER, ET AL., 
Defendants. Civil Action No. 1:17-CV-2989-AT 








Pursuant to 28 U.S.C. § 1746, J. ALEX HALDERMAN declares under 
penalty of perjury that the following is true and correct: 

1. I hereby incorporate my previous declarations as if fully stated herein. 
I have personal knowledge of the facts in this declaration and, if called to testify as 
a witness, I would testify under oath to these facts. 

2: I have reviewed the “Letter Report” prepared by Pro V&V concerning 
version 5.5.10.32 of the Dominion BMD software (Dkt. No. 939). The report makes 
clear that Pro V&V performed only cursory testing of this new software. The 
company did not attempt to independently verify the cause of the ballot display 


problem, nor did it adequately verify that the changes are an effective solution. Pro 
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V&V also appears to have made no effort to test whether the changes create new 
problems that impact the reliability, accuracy, or security of the BMD system. 

3. This superficial testing is deeply concerning, because Pro V&V’s 
characterization of the source code changes indicates that they are considerably more 
complicated than what Dr. Coomer previously testified was the threshold for 
considering a change to be “de minimis”: “literally a one-line configuration change 
in some config file that would have no material impact on the system” (Dkt. No. 905 
at 102:18-103:14). Instead, Pro V&V states that Dominion made two kinds of 
changes and modified lines in five different source code files. In general, changes 
that affect more lines of source code or more source code files are riskier than smaller 
change, as there is a greater likelihood that they will have unintended side-effects. 
Changes to source code files, as Dominion made here, also tend to be riskier than 
changes to “config[uration] files.” 

4. The nature of the changes gives me further reason for concern. 
According to Pro V&V, one change involved changing a “variable declaration” to 
modify the “type” of a variable. A variable’s type determines both what kind of data 
it holds and how operations on it function. Although changing a variable declaration 
often involves differences in only one line of source code, the effect is a change to 


how the program operates everywhere the variable is used, which could involve 
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many parts of the source code and span multiple files. For this reason, changing a 
variable’s type frequently introduces new bugs that are difficult to detect. I have 
often experienced such problems while writing software myself. 

>: It is not possible to evaluate the effects of such a change by analyzing 
only the lines of source code that have been modified. Yet Pro V&V’s description 
of its “source code review” is consistent with having done nothing more. The 
company could have engaged an expert in the specific programming language to 
analyze the quality of the changes and look for subtle side-effects throughout the 
code, but it appears that they did not. 

6. Instead, the report states that “Pro V&V conducted functional 
regression testing.” Regression testing has a well-defined meaning in computer 
science: checking that a change to a system does not break its existing functionality. 
After a change to a voting system like this, rigorous regression testing is essential 
for ensuring that the system’s reliability, accuracy, and security are not degraded. 
Yet the testing Pro V&V describes performing is not regression testing at all. 
Instead, the company focused entirely on checking whether the ballot display 
problem was fixed and makes no mention of testing any other functionality 


whatsoever. 
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7, Even for this limited purpose, Pro V&V’s testing methodology is 
inadequate. They first tried to observe the error while using the current version of 
the BMD software, 5.5.10.30. They managed to trigger it using an artificial test 
ballot but failed to reproduce it using the real ballot design from Douglas County 
(where the problem was observed during L&A testing) even after 400 attempts.! 
They then performed the same checks using the 5.5.10.32 software. Pro V&V’s basis 
for concluding that the new software corrects the problem is that they were unable 
to trigger the error with either ballot after 400 tries. Yet this ignores the obvious 
possibility that the error might simply be eluding them, as it did with the Douglas 
County ballot under version 5.5.10.30. 

8. That is the full extent of the testing described in Pro V&V’s report. 
They did not test that the other functionalities of the machine are not impacted by 
the change. They did not test that the BMD selected and printed results accurately, 
nor did they test that security was unaffected. Tests only answer the questions you 
ask. Here—regardless of what Pro V&V intended—the only questions asked were: 
“Is the stated error observed when using the old software?” and “Is the stated error 


observed when using the new software?” They did not ask, “Is Dominion correct 


' It is curious that Pro V&V was unable to reproduce the problem experienced in 
Douglas County, but they appear not to have made any effort to investigate this. 
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about the cause of the problem?” They did not ask, “Does this change absolutely and 
completely fix the issue?” Most importantly, they never asked or answered the key 
question for determining whether the change is de minimis, “Will these 
modifications have any impact on the rest of the voting system’s functionality?” 

9. Even if the change does correct the bug without introducing new 
problems, it still represents a significant security risk, because of the possibility that 
attackers could hijack the replacement software to spread malware to Georgia’s 
BMDs. 

10. Defendants say they will guard against this using hash comparisons, but 
the hash comparison process they have described is inadequate in several ways.” As 
I have previously explained, examining the hash that the BMD displays on screen 
provides no security, because malware on the BMD could be programmed to 
calculate and display the expected hash. Although the State now says it will perform 
some acceptance testing at a central facility, such testing has limited value at best. 
Even if performed correctly—by securely computing the hash of the software using 


a device that is assuredly not affected by malware—acceptance testing can only 





* The Pro V&V report lists the hash of a file named ICX.iso, which presumably 
contains the APK as well as other files. Without access to the ICX.1so file, I cannot 
confirm whether that the software purportedly being installed on the BMDs is the 
same as the software Pro V&V built and tested. 
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confirm that the new software was not modified between Pro V&V and the test 
facility. It does not ensure that the new software actually matches Dominion’s source 
code or that it will not be modified during later distribution to counties or installation 
on the tens of thousands of BMDs statewide. 

11. The report mentions that Pro V&V performed a “trusted build” of the 
new software. This refers to the process by which Pro V&V compiled the source 
code to produce the APK file for distribution and installation throughout Georgia. 
The result of compiling source code, often called a software “binary,” is in a non- 
human readable format, and it is not possible in general to confirm that a binary 
faithfully matches source code from which it was purportedly compiled. As a result, 
if Pro V&V were to modify the BMD software to introduce malicious 


functionality—or if attackers who infiltrated their systems were to do so*—there 


> Notably, Pro V&V’s website (http://www.provandv.com/) does not support 
HTTPS encryption, and modern web browsers warn users that it is not secure, as 
shown below. In my experience, organizations that fail to support HTTPS are 
likely to be ignoring other security best practices too, which increases the 
likelihood of attackers successfully infiltrating their systems. 





€ C A Not secure brovandv.com 


PRO V&V 


&, 





Company Services Facilities 
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would be no readily available way for the State or Dominion to detect the change. 
The State’s election security experts themselves have emphasized the risk of election 
manipulation by so-called “insiders.” 

12. Defendants state that Pro V&V has submitted the report to the EAC to 
seek approval for a de minimis change. The EAC’s de minimis software change 
process was introduced less than a year ago, and, as far as I am aware, it has only 
been invoked on one or two occasions so far. In my opinion, the EAC cannot make 
an informed determination as to whether the new Dominion software meets the de 
minimis standard based on the information contained in Pro V&V’s report, and I 
sincerely hope the agency demands more rigorous testing before allowing the 


software to be used under its certification guidelines. 


I declare under penalty of the perjury laws of the State of Georgia and the 
United States that the foregoing is true and correct and that this declaration was 


executed this 3rd day of October, 2020 in Ann Arbor, Michigan. 


ZL 


_ ALEX HALDERMAN 
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IN THE UNITED STATES DISTRICT COURT FOR 
THE NORTHERN DISTRICT OF GEORGIA 





ATLANTA DIVISION 
) 
DONNA CURLING, et al. ) 
) 
Plaintiff, ) 
) CIVIL ACTION FILE NO.: 1:17- 
vs. )  ev-2989-AT 
) 
BRAD RAFFENSPERGER, et al. ) 
) 
Defendant. ) 
) 
) 





SUPPLEMENTAL DECLARATION OF KEVIN SKOGLUND 
KEVIN SKOGLUND declares, under penalty of perjury, pursuant to 

28 U.S.C. § 1746, that the following is true and correct: 

1. I hereby incorporate my previous declarations as if fully stated herein. I 
have personal knowledge of all facts stated in this declaration, and if 
called to testify, I could and would testify competently thereto. 

2. I have read the Letter Report regarding “Dominion Voting Systems ICX 
Version 5.5.10.32” from Pro V&V to Michael Barnes dated October 2, 
2020 (“Letter Report’). 

3. The Letter Report describes Pro V&V’s evaluation of a proposed code 
change by Dominion to address a flaw in the current ICX software 


related to reliably displaying two columns of candidates. 
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4. Pro V&V’s evaluation is inadequate to verify Dominion’s opinion of the 
root cause of the error, Dominion’s proposed fix for the error, or whether 
the nature of the proposed change is considered “de minimis” as defined 


by the U.S. Election Assistance Commission (“EAC”). 


High Impact Changes 

5. The Letter Report describes changes that are potentially high impact. 

6. I expected the change to be limited to one or two lines in a configuration 
file based its description in the hearings. A configuration file change 
would provide a new value for the existing code to use. 

7. The impact of changing a value being used by code is far less than the 
impact of changing the code itse/f, in the same way that changing the 
furniture in a house has less impact than moving walls. The value may be 
different but it will travel the same pathways through the code during 
operation. The structure and governing rules are unchanged. 

8. Instead, the Letter Report describes two sets of changes to the source 
code itself in a total of five files. It does not quantify the number of lines 
changed, but it must be at least five. These are not merely configuration 
changes. Variable and function definitions in the source code are 


changed. 
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9. The changes described may sound minor, for example changing a 
variable from an integer (e.g., 123) to a string (e.g., “123”), but I would 
give them no less consideration. I have broken plenty of code making 
similar changes. 

10.One reason is that any code elsewhere in the program that uses a changed 
variable or function could be impacted. Another part of the code may act 
correctly when given 123 but act incorrectly when given “123”. The first 
can have numbers added and subtracted, while the second can be 
searched for a specific character, but the reverse is often not true. 

11.The Letter Report describes a source code review limited to the changed 
lines of source code. The code comparison performed is similar to 
reviewing the changed text in a legal blackline. It does not appear that 
Pro V&V looked throughout the source code for other interactions which 
could prove problematic. 

12.The Letter Report states that Dominion believes the problem is a 
collision of resource identifiers between their software and the 
underlying operating system. I think it’s a fair analogy to say that 
Dominion’s software and the operating system sometimes try to park in 
the same parking space. 

13.In my experience, an abundance of caution is necessary when the 


operating system and software running on it are working in a shared 
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space and not playing well together. A misstep could create additional 
problems in their interactions and any change should be carefully 
considered and well tested. 

14.The Letter Report does not describe any review of the proposed 
software’s interaction with the operating system. It does not mention the 
involvement of any expert on the operating system or an opinion 
regarding colliding resource identifiers—the reported cause and the target 


of the resolution. This is a concerning oversight. 


Inadequate Testing of the Root Cause of the Error 

15.Pro V&V was unable to reliably reproduce the error with the current 
version of the software, ICX 5.5.10.30. In fact, they reported producing 
the error only once out of 810 total attempts. 

16.Pro V&V appears to have taken Dominion’s word for the root cause of 
the error. The Letter Report does not mention any independent 
investigation to determine the cause. 

17.The description of Pro V&V’s first test, using a sample election database, 
begins with a procedure likely suggested by Dominion—toggling 
between font sizes to trigger the error. When the 10th toggle produced the 
error, Pro V&V considered the root cause to be confirmed. That is in 


itself not unreasonable. 
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18.However, the same test procedure was later performed using an actual 
election database, from Douglas County where logic and accuracy testing 
had revealed the error previously, and 400 toggles and several reboots 
could not produce the error. Of two test cases that should have both 
failed, one failed and one did not. 

19.Despite these conflicting test results, Pro V&V did not investigate further. 
They did not consider what might be different between these two test 
cases to cause contradictory results. They did not consider if the sample 
election database at the center of their tests was a poor substitute for a 
real database. They did not consider that the root cause could be different, 
or that toggling the font size might not be a good trigger for the error. 

20.Pro V&V wrote the Letter Report without having confirmed that 


Dominion’s opinion of the root cause was correct. 


Inadequate Testing of the Proposed Fix for the Error 
21.It is impossible to verify that a proposed change sufficiently addresses an 
error if the root cause is unconfirmed. A change may only appear to fix 
the error due to coincidence. Correlation is not causation. A change may 
incompletely fix the error or create subtle side effects. 
22.1 have learned this lesson many times while fixing software bugs during 


my 23 years as a programmer, and I teach that lesson in a course on 
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software testing. I have also had the practical experience of taking a car 
to the auto mechanic over and over as they try different solutions for an 
uncertain cause. 

23.Pro V&V’s basis for determining that the error was fully resolved by the 
proposed change, ICX 5.5.10.32, was that the error was not observed 
after 400 toggles and several reboots. 

24.This is not an ideal test case because “absence of evidence is not 
evidence of absence.” The conclusion requires an assumption that 
subsequent attempts would not surface the error. Given that the first test 
required only 10 toggles to trigger the error, after 400 toggles and several 
reboots I might have made a similar assumption. 

25.However, when Pro V&V performed the subsequent test on the Douglas 
County database and also could not observe the anticipated error after 
400 toggles and several reboots, they did not revisit their conclusion 
about ICX 5.5.10.32. They should have. 

26.They did not consider that the error could be eluding them in ICX 
5.5.10.32 as it was with ICX 5.5.10.30 using Douglas County’s database. 
They did not consider that their assumption that 400 toggles was enough 
to surface the error was wrong. They did not consider that the proposed 


change might be an insufficient remedy for the problem. 
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27.To be clear, I am not suggesting that Dominion’s opinion of the root 
cause is incorrect or that Dominion’s proposed change does not fix it. I 
am saying that testing was insufficient to verify either one. Pro V&V 
showed no skepticism about their findings when the results created a 
logical fallacy. 

28.Even more surprising, Pro V&V had a real election database from 
Douglas County in hand, yet they did not test it with ICX 5.5.10.32. The 
stated purpose of this eleventh-hour software change was to resolve this 
error for the current election database, rather than create and distribute a 
new one. The test lab hired to confirm that the new software will work 
with the current database in a matter of days did not even check. 

29.Pro V&V wrote the Letter Report without having confirmed that 
Dominion’s proposed fixed correctly addressed the error, neither on the 
sample election database nor on the election county database counties are 


planning to use. 


Inadequate Testing of “De Minimis” 
30.The EAC defines a de minimis change as: 
A de minimis change is a change to a certified voting system’s 
hardware, software, TDP, or data, the nature of which will not 


materially alter the system’s reliability, functionality, capability, or 
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operation. Under no circumstances shall a change be considered de 
minimis if it has reasonable and identifiable potential to impact the 
system’s performance and compliance with the applicable voting 
Standard. ! 
31.The Letter Report does not describe any testing to demonstrate that the 
nature of the proposed change does not “‘materially alter the system’s 
reliability, functionality, capability, or operation” and does not have a 
“reasonable and identifiable potential to impact the system’s performance 
and compliance with the applicable voting Standard.” 
32.Pro V&V ignored these critical, foundational requirements in their 
testing. 
33.Pro V&V did not test whether any other functionalities of the device are 
impacted. They did not test whether the new build of the software 
correctly selects candidates in a series of contests and accurately prints 
them on a ballot. They did not test other screens to ensure that a fix to the 
two-column layout did not break another. They did not check if it was 
still possible to change languages or screen contrast, or whether the audio 
ballot, used by voters with disabilities, was still working. They did not 


test whether the device’s security was impacted. 





1 “Testing and Certification Program Manual,” Section 3.4.2, available at: https:// 
www.eac.gov/sites/default/files/eac_assets/1/6/Cert_Manual_7_8_15_FINAL.pdf 
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34.Pro V&V did not answer the litmus test for de minimis. Does the change 
materially alter the system’s reliability, functionality, capability, or 
operation? 

35.The Letter Report describes “functional regression testing,” which might 
help answer this question, but it misuses the term. 

36.Regression testing is a “re-running functional and non-functional tests to 
ensure that previously developed and tested software still performs after a 
change.””2 It is so named because a regression is a step backwards in the 
development of software, the proverbial “two steps forward, one step 
back.” 

37.Pro V&V examined the rendering of the two-column layout in their tests. 
Regression testing would validate that other parts of the software still 
perform correctly. 

38.Regardless of Pro V&V’s determination, this change is not a de minimis 
change until the EAC reviews it and approves in writing. “The EAC has 
sole authority to determine whether any VSTL endorsed change 
constitutes a de minimis change under this section. The EAC will inform 


the Manufacturer and VSTL of its determination in writing.”? 





2 “Regression Testing”, Wikipedia, available at https://en.wikipedia.org/wiki/ 
Regression_testing 


3 “Testing and Certification Program Manual,” Section 3.4.3 
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39.The EAC prohibited any software changes to be considered de minimis 
until recently out of concern that even small changes might alter the 
system functionality, due to potential ripple effects I described earlier. 

40.Given that the process is new, I expect that the EAC will scrutinize any 
request for a software de minimis change carefully. I expect the EAC to 


ask for more rigorous testing and reporting than the Letter Report. 


Concerns about the Time Remaining for Review and Testing 
41.In my previous declaration I expressed concern about a software change 
at this late date and fear that time pressures may result in less thorough 
review and testing of the proposed change. 
42.The Letter Report is a wholly inadequate review. Its tests are incomplete. 
43.The EAC has not yet begun to review this proposed software change. 
Using the revised software without the EAC’s approval will void the 
federal certification. EAC approval must be granted in the next five 
business days to allow early voting to commence on the following 
Monday. 
44.Yet the uncertified software has been distributed and counties have been 


instructed to install it on over 30,000 ImageCast X devices and to begin 


testing them. 
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45.Last week, I heard Michael Barnes describe the current procedures for 
logic and accuracy testing. The procedures do not test every device, for 
every ballot style, for every candidate. The procedures do not include any 
additional testing related to this error. This problem and others could pass 


through logic and accuracy testing undetected. 


Executed on this date, October 4, 2020. 


ma 


Kevin Skoglund 
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DECLARATION OF HARRI HURSTI 

Pursuant to 28 U.S.C. § 1746, HARRI HURSTI declares under penalty of 
perjury that the following is true and correct: 

1. This declaration supplements my prior declarations (Docs. 680-1, 
800-2, 809-3, 860-1, 877, and 923-2) and I stand by the statements in those 
declarations. 

2D: I arrived at the Fulton County Election Preparation Center (“EPC”’) on 
October 1, 2020 around 3:45pm. I was there in my capacity as an expert engaged by 
the Coalition Plaintiffs to conduct a Rule 34 inspection. (Exhibit 1) . I was 
accompanied during part of my visit by Marilyn Marks of Coalition for Good 
Governance. 

3, My goal for this observation and inspection was to review the ongoing 
updating of the Dominion software for Fulton County ballot marking device 
("BMD") touchscreen units to ICX software version 5.5.10.32. It is my 
understanding that Fulton has an inventory of over 3,300 BMD touchscreens, all of 
which are to be updated with this software. A number of the machines were in the 
EPC warehouse and were staged to be updated or marked after the update had been 
completed. 

4. Upon our arrival, Ms. Marks and I were informed by Derrick Gilstrap, 


the manager of EPC, that all of the people working to upgrade the devices were 
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Dominion technicians. Mr. Gilstrap stated that he did not feel comfortable 
installing a last-minute software change, and did not want Fulton County staff to 
be responsible for installing it. He told us that he told Dominion to conduct this 
operation, prior to having his staff install the November 2020 election 
programming and Logic and Accuracy testing (“LAT”). 

5, Mr. Gilstrap told us that after the software update step that LAT 
would immediately begin, and made no mention of Acceptance Testing that should 
occur prior to LAT. 

6. Acceptance Testing is an almost universally mandated basic test of 
the hardware and software when a change or repair to either has been made before 
counties are permitted to install election programming and deploy voting system 
components. Acceptance testing must be performed on each unit, and cannot be 
performed on a sample basis. Fulton’s failure to conduct such testing should be a 
serious warning sign of further recklessness in the installation of inadequately 
tested software. 

ve Mr. Gilstrap stated that Dominion had started the software update 
project with four workers, but soon realized that the task would take extended 
periods of time. Mr. Gilstrap stated that Dominion had accordingly increased the 
workforce to 14 and expected the installation work to be completed on Monday, 


October 5. 
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8. The new software was contained on USB sticks. However, there was 
no inventory management present for the USB sticks. There also was no inventory 
control for the technician authorization smartcards, which provide access to the 
controls of the touchscreen. Workers did not sign or otherwise document when 
they took possession or returned the technician cards and software upgrade USB 
sticks. Those items were in an open plastic bag which was sometimes placed on 
table, and sometimes carried around the working area by the manager. Anyone was 
able to pick up a USB stick or drop them there freely, permitting the easy 
substitution of USB sticks containing malware or to leave the premises with copies 
of the software update. 

9. Some workers worked one BMD touchscreen machine at the time, 
while others simultaneously worked on 2 or 3 machines. There was no 
accountability for how many sticks and technician smart-cards each worker had in 
their possession. Clearly, the USB sticks were not considered to be security 
sensitive items at all. 

10. Some of the workers had instructions for software update visible in 
their pockets, while others did not seem to have the instructions readily available. 
One worker showed me the instructions, but it was different from the instructions I 
had seen that were sent to the counties. None of the technicians that I observed 


were following the instructions as they installed the new software. 
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11. Technicians were not following a common process, and they all made 
their own variations on the workflow. In my experience, this can negatively affect 
the quality and reliability of the software installation. Many workers were texting 
and making phone calls while working and not focusing on their work. As a result, 
I observed repeated human errors such as skipping steps of the process. 

12. Some workers consistently took an extra step to destroy previous 
application data before uninstalling the old version of the software. Uninstalling 
software packages results in destroying application data, but that is known to be 
unreliable in old versions of Android. The step they took is ensuring, among other 
things, destruction of forensic evidence of Fulton’s use of the equipment in prior 
elections. 

13. To avoid destruction of all forensic evidence from the BMDs, a 
number of images of the electronic data contained on the BMDs should be taken 
from a sample of them before installation of the new software. 

14. As part of the updating process, the workers are directed to enable the 
“Install from Unknown Sources” setting. This is an insecure mode because it turns 
off the operating system verification of trusted sources and therefore allows 
software from any source to be installed. During the 45 minutes of my observation, 
I observed that many units had been left in insecure mode. I estimate 15% of the 


units were already in the insecure mode when the work began on them, having 
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been left that way during the last software installations, or because of interim 
tampering. 

15. As described before, most workers I observed were not focusing on 
the work they were tasked to do, and as result, they were accidentally skipping 
steps. I observed that, as result of these human errors, the units were erroneously 
left in the insecure mode either by the workers skipping the step to place the 
machine into the secure mode after upgrade, or doing the step at such a fast pace 
that the system did not register the touch to toggle the switch and the worker did 
not stop to verify the action. 

16. The State Defendants and Dominion have repeatedly overstated the 
value of their hash test, but my observation showed that they themselves are not 
relying on such test as a control measure. Dominion workers are not even 
checking the hash value. I deliberately followed many workers when they 
processed the units. During over 45 minutes of observation, none of the workers 
took the step of verifying the hash value. Some workers did not realize that the 
upgrade had failed and the mistake was only caught by persons who were closing 
the cabinets when and if they looked at the software version numbers before 
closing the doors. 

17. I also observed random errors that were not caused by humans. For 


example, software sometimes refused to uninstall because the uninstall button was 
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disabled, or the installation silently failed. The technicians treated devices with 
issues by simply rebooting them. Technicians made no effort to diagnose or 
document the cause of the issues. The casual nature of dealing with the 
irregularities caused me to conclude that these abnormal incidents are 
commonplace. 

18. Based on my observations of the software update, I would anticipate 
that these machines are likely to behave inconsistently in the polling place, 
depending on a number of factors including the care taken in the software 
installation process. 

19. The current abbreviated LAT protocol adopted by Fulton County and 
the State cannot be relied on to identify problems created by the new software or 
its installation (or other problems with programming and configuration unrelated to 
the new software). Even if counties were conducting the full LAT required, it is 
but one step that is needed, and is quite insufficient for ensuring the reliability of 
the BMD touchscreens—which at the end of the day, simply cannot be done. 

20. Inmy professional opinion, the methods and processes of adopting 
and installing this software change is completely unacceptable. The methods and 
processes adopted by Dominion and Fulton County do not meet national standards 
for managing voting system technical problems and remedies, and should not be 


accepted for use in a public election under any circumstances. 
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21.  Itis important that full details of the software change made be 
available for analysis and testing to determine the potential impact of the changes. I 
concur with Dr. Halderman’s opinion in Paragraph 8 of his September 28, 2020 
declaration (Doc. 923-1), in which he states that if the problem is as limited as 
described by Dominion, it could have been addressed with far less risk by the State 
without making an uncertified, untested software change. 

22. In my opinion, the installation of the last-minute software change adds 
intolerable risk to the upcoming election, and the simple solution of removing the 
BMD units from the process and adopting hand marked paper ballots is imperative. 

23. I note that I wanted to document the upgrading process, but Mr. 
Gilstrap told me that I was prohibited from taking photographs or video. I showed 
him the Rule 34 inspection document and pointed out the paragraph permitting 
photographing. He read that carefully but told me that he needed to clear that with 
his superiors before I could start taking pictures. He never cleared this with his 
superiors while we were there. 

I declare under penalty of the perjury laws of the State of Georgia and 
the United States that the foregoing is true and correct and that this declaration 


was executed this 4 day of October, 2020 in Atlanta, Georgia. 





Harri Hursti 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE NORTHERN DISTRICT OF GEORGIA 


ATLANTA DIVISION 
DONNA CURLING, ez al. 
Plaintiffs, 
CIVIL ACTION 
v. 


FILE NO. 1:17-cv-2989-AT 
BRAD RAFFENSPERGER, et al., 


Defendants. 








STATE DEFENDANTS’ NOTICE OF FILING 
REDACTED VOTING SYSTEM TEST LABORATORY REPORT 


Pursuant to the Court’s September 30, 2020 docket entry, and as 
discussed in Defendants’ Notice of Filing Regarding the Court’s Request for 
Documentation, [Doc. 929], State Defendants provide notice of filing a 
redacted copy of the Voting System Test Laboratory Report, attached hereto 
as Exhibit 1. 


Respectfully submitted this 5th day of October 2020, 


/s/ Carey Miller 
Vincent R. Russo 


Georgia Bar No. 242628 
vrusso@robbinsfirm.com 
Josh Belinfante 

Georgia Bar No. 047399 
jbelinfante@robbinsfirm.com 
Carey A. Miller 

Georgia Bar No. 976240 


Case 2:20 a828@1 3457.07 GEOBor AD bihkimaint3h 9-46 CHASER BOOESEAD HARES GHG) 496 of 119 


cmiller@robbinsfirm.com 

Alexander Denton 

Georgia Bar No. 660632 
adenton@robbinsfirm.com 

Robbins Ross Alloy Belinfante Littlefield LLC 
500 14th Street, N.W. 

Atlanta, Georgia 30318 

Telephone: (678) 701-9381 

Facsimile: (404) 856-3250 


Bryan P. Tyson 

Georgia Bar No. 515411 
btyson@taylorenglish.com 
Bryan F. Jacoutot 

Georgia Bar No. 668272 
bjacoutot@taylorenglish.com 
Diane F. LaRoss 

Georgia Bar No. 430830 
dlaross@taylorenglish.com 
Loree Anne Paradise 

Georgia Bar No. 382202 
lparadise@taylorenglish.com 
TAYLOR ENGLISH DUMA LLP 
1600 Parkwood Circle, Suite 200 
Atlanta, GA 30339 

Telephone: 678-336-7249 


Counsel for State Defendants 
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CERTIFICATE OF COMPLIANCE 
Pursuant to L.R. 7.1(D), the undersigned hereby certifies that the 
foregoing STATE DEFENDANTS’ NOTICE OF FILING REDACTED 
VOTING SYSTEM TEST LABORATORY REPORT has been prepared in 
Century Schoolbook 18, a font and type selection approved by the Court in 


L.R. 5.1(B). 





/s/ Carey Miller 
Carey Miller 
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Exhibit 1 
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Letter Report PRO V& 





To: Michael Barnes 

From: Wendy Owens - Pro V&V, Inc. 

CC: Jack Cobb - Pro V&V, Inc. 

Date: October 02, 2020 

Subject: Dominion Voting Systems ICX Version 5.5.10.32 


Dear Mr. Barnes: 


Pro V&V is providing this letter to report the results of the evaluation effort on the ICX version 5.5.10.32. 
An examination was performed to confirm that this version of the ICX software corrected the issue with 
displaying of two column contests found in ICX version 5.5.10.30. 


Background 


Pro V&V was contacted by Georgia Secretary of State Office and Dominion Voting System to analyze 
an issue that was discovered in Georgia’s Election Logic and Accuracy Testing (L&A testing) for the 
2020 General Election. It was discovered during L&A testing that a display error, under certain 
conditions, would occur where the second column of candidates would not be displayed properly. 
Dominion Voting Systems researched the issue and found that a static container identifier was causing a 
collision with an Android automated process for assigning container identifiers. This collision caused the 
display for the second column candidates not to be rendered on the screen properly and occurred so 
infrequently that it appeared intermittent. 


Test Summary 


Dominion Voting Systems submitted source code for ICX version 5.5.10.32 to Pro V&V. Pro V&V then 
conducted a comparative source code review comparing ICX version 5.5.10.32 to the VSTL-provided 
previous ICX version 5.5.10.30. The source code review found two source code changes in a total of five 
files. One change was a variable declaration change the variable type to a string from an integer and 
changing the assignment from a static number to assigning another variable. The other update was to 
change a function call passing a “wrapper tag” instead of a “wrapper ID”. All other source code remained 
constant. After conducting the source code review, a Trusted Build process was conducted. The Product 
from this build is the ICX.iso file. The SHA-256 hash for this file is as follows: 


CX is ~ 
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Pro V&V conducted functional regression testing using version 5.5.10.30 and 5.5.10.32. An ICX 
machine was loaded with 5.5.10.30 and an election containing two 2 column contests. Pro V&V toggled 
between “Normal” and “Big” font sizes. Approximately on the 10" toggle the column disappeared as 
presented in Photograph 1.and 2 below: 


Tabulator: 6 


Maximum Candidates Modified { Rs { 
Language Text Size 
az 7 sais 


County, Candidacy 1 


Cherie Burgess Cristopher Leon 
Jay Landry Alfred Freeman 
Garth Craft Freida Buck 
Aida Campbell Cruz Mendoza 
Trinidad Mcclure Micah Leblane 
Zelma Mcgee Nichole Prince 
Sonya Johns Alexis Sykes 
Allyson Chan Donnell Maxwell 


Seth Turner Stevie Sanders 


Casandra Hobbs Jody Hoffman 


Robbie Carson 


Review € Previous 





Photograph 1: Max Candidate Election Contest One 
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— 98% = 2020-09-39 | Wednesday | 07:08PM 
Maximum Candidates & [ AA | 
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Language TextSize Audio View 


More 


| County, Candidacy 1 


Cherie Burgess 
Jay Landry 
Garth Craft 

Aida Campbell 
Trinidad Mcclure 
Zelma Mcgee 
Sonya Johns 
Allyson Chan 
Seth Turner 


Casandra Hobbs 


Robbie Carson 


© Dominion Voting 


Total ballots cast: 0 





Photograph 2: Second column was not rendered. 
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Che 


After reproducing the issue. The same device was load with the ICX version 5.5.10.32 and the same 
election. Pro V&V toggled 50 times then rebooted, 100 times then rebooted and finally 250 times. Pro 
V&V never observed the issue. 


Pro V&V requested Douglas County Georgia’s 2020 General Election database that had produced the 
issue, but could not reproduce the issue for the ICX software version 5.5.10.30. Even though Pro V&V 
could not reproduce the issue, Pro V&V ran the same test as the test election toggling 50 times then 
rebooted, 100 times then rebooted and finally 250 times. Pro V&V never observed the issue. 


Conclusion 


Based on the review of the source code and nature of the change, Pro V&V recommends the change be 
deemed as de minimis. Based on the testing performed and the results obtained, it was verified through 
source code review and functional testing that the issue found in ICX version 5.5.10.30 can not be 
reproduced in ICX version 5.5.10.32. 


Should you require additional information or would like to discuss this matter further, please contact me 
at 256-713-1111. 


Sincerely, 


Wendl Owene 


Wendy Owens 
VSTL Program Manager 
wendy.owens @ provandv.com 
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PROCEEDINGS 


(Atlanta, Fulton County, Georgia; October 1, 2020.) 


THE COURT: Good morning. Counsel, would you just 


check the extra numbers here -- anyone with an extra number 





here or person here to make sure everyone here is identified 





with you. I can see what they appear to be. 
Mr. Martin, is this everybody that you have let in? 


COURTROOM DEPUTY CLERK: Yes, ma'am, this is 





everybody. 

THE COURT: All right. So if -- the two individuals 
who are just solely appearing by telephone, can you identify 
yourselves? 


MS. RINGER: Phone number ending in 8737 is Cheryl 





Ringer from Fulton County. 

THE COURT: Okay. Very good. That is fine. 

And the person whose number ends in 8993, would you 
identify yourself. 


MR. FRONTERA: Your Honor, can you hear me? This is 





Mike Frontera, general counsel, with Dominion Voting Systems. 
THE COURT: Very good. Thank you very much. All 
right. That is fine. Everyone is authorized to be on. 


Thank you, everyone, for being here. I want to say 





Ps 


from the start that we have this now on the platform -- a 








different Zoom platform, and we are -- I am -- I have 








authorized the videotaping of the hearing solely for the 
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purpose of if I determine that some portion of this really 


should have been on the public record that it can be made 





available on the record. 
Not knowing what was going to be discussed exactly 


and understanding that there might be some confidentiality 





issues, I decided that we should just proceed in this way, 


rather than by making it open and then trying to pull it back. 





So that is the purpose of videotaping it. I don't really -- 


normally wouldn't do that. 








But under the emergency circumstances here, I have 





proceeded this way. And I think it is the soundest way of 





proceeding in that way. And also I can make any portion of 


this that would be public be available to the public. 





Additionally, I want to note though that the 


videotape is not -- will not be the transcript of record. The 


only transcript of record of that will be created by Ms. Welch 








as the court reporter in this matter. And you are not to refer 


c= 


to the videotape at any point as kind of the official record in 











this matter. And, of course, the transcript will be filed. 
I am -- just was, frankly, perplexed by the response 


that the State filed last night. And I know everyone is busy. 





I'm not trying to in any way minimize how busy you are. And -- 
and Mr. Russo already has told me from the start that he has to 
be out -- that he has to be complete by 10:00. 


Are you starting the hearing in front of Judge Brown 
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at 10:00, Mr. Russo? 


MR. RUSSO: Your Honor, that hearing is at 10:00. 





But we have sent two of our colleagues there to do it so we 
could be here. So Mr. Belinfante and Mr. Tyson are there, and 
Mr. Miller and me are here. So you have got us today. 

THE COURT: Okay. Very good. Wonderful. 


MR. MILLER: And I think the 10:00 issue was specific 











Dr. Coomer's availability. 





THE COURT: All right. Very good. So please, 








everyone, bear that in mind as to Dr. Coomer's availability 
because if there is something that he needs to address early 


on, whether it is from the perspective of the Court or the 





State, let's be sure we just jump ahead and get his input. 

MR. RUSSO: Your Honor, also, we have the staff from 
the Secretary's office on standby. We have Mr. Germany, the 
general counsel, on right now. But Mr. Sterling and Mr. Barnes 


are -- we told them to continue working since they have 





election stuff going on and that if you needed something from 


them we would patch them in accordingly. 





THE COURT: That's fine. All right. Well, as I 
understand it, the -- from what you -- from what the State 


submitted last night -- and it wasn't on the record. That was 





just, I think, a letter from counsel. It was that you -- that 





basically the State defendants were proceeding, that you were 


sending the software out today -- the software to jurisdictions 
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the tonality o:! 
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and basically this is a distraction that 





It was a quick letter. 


let me just say -- start from the start is that I 








think I have endeavored to work cooperatively with everyone. I 
have an order to issue. 


it is just simply -- you know, 


which is certainly -- 


you in the past that 


this election saying, 


paper ballot. 
But 


know what will 


still 





happen 


Court is entitled to, 


needed to issue an intelligent decision. 


of circumstances. 


And I 





am —— 





you know, given everything I 





am very reluctant to even 





Well, that was 





I need to -- whatever it says, whether 


doesn't do anything at all, 


have told 





consider in 


oh, suddenly do a sudden change to the 


-- this is still a record. 


And I don't 





in the days ahead. But I think that the 


with respect, be given the 














I don't know who thought 


information 


And this was a change 


I wouldn't have 


issued a decision without full knowledge of the circumstances 


that have arisen. 
I think everyone has generally been very pro 
But this is not an acceptabl 


short on sleep and at their wits' 


P3 











understand it that way. I sure am very short on 


And there is a 


circumstances. 


So I humanly recognize all of that. And so 
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end on some things. So 


I don't mean this personally against anyone. 


essional with me. 


le response, and I know everyone is 





sleep too. 


lot of stress under these 
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just sort of had to breathe in and say, all right, where are we 





going from now, once I got the response and just say, all 





right, you know, without any drama, I want to understand what 


1s going on. 





And that -- the expectation I had was not the -- that 





things were just proceeding and that I wouldn't basically know 


what was happening. 





So I think that is -- just as an initial matter, that 








is where we're at. I mean, I am, you know, at 95 percent on 





having an order ready to be timely issued. And I held it back 
while this is going on. 
And, of course, that is why on Monday we issued the 


order on the one thing that was clearest that needed to be 





acted upon as soon as possible. But I was holding back as soon 





as I heard anything was going on. 
So let's just talk about what has happened. My 


understanding from the letter on September 29th that is on the 





record that -- as opposed to the letter that I received 


yesterday from counsel that the acceptance testing -- there 





would be acceptance testing that would occur before there was 


going to be distribution. 


I guess it is a filing now. I'm sorry. I didn't 
realize that counsel's letter was filed. So excuse me for 


that. 





In any event, I thought there was going to be 
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C= 


acceptance testing before there was distribution. And maybe 








there was, and maybe I misunderstood what was instead stated in 


the brief letter. 








So, first of all, let's just start off just as to 





Did that occur? 





MR. RUSSO: Your Honor, yes. So, first, you know, 








let me say we filed the letter under seal because that is what 


was discussed on Monday. As a letter, you said to file it 





under seal. So that is why we filed it that way. 

THE COURT: That is fine. 

MR. RUSSO: We didn't necessarily think there was 
something in there that was attorneys' eyes only or anything to 


that extent. 





THE COURT: All right. Then I will lift the seal. 
Okay. Fine. 


MR. RUSSO: In terms of the acceptance testing, the 








Fam oy 





Secretary of State's office did conduct acceptance testing 





prior to distribution of the update. That is correct. 


Mr. Barnes did that. And then the distribution proceeded. 


THE COURT: And when did Mr. Barnes do that? 





MR. RUSSO: I believe his acceptance testing was 
done -- conducted yesterday. Mr. Miller might -- might know if 
it was done yesterday or the day before. Frankly, my days are 
starting to run together right now. 


THE COURT: Yeah. 
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MR. MILLER: Your Honor, I believe it was done Monday 
and Tuesday. And so the kind of process through that -- the 
acceptance testing was, you know, essentially receiving the 
application from Pro V&V and running through just a typical 
acceptance testing and, you know, primarily ensuring also that 
the rendering issue that was discovered in logic and accuracy 
testing was not recurring. 

And, importantly, you know, there's -- acceptance 
testing was not the only thing being done. The voting system 
test laboratory was also doing its part. 

And, frankly, Your Honor, as to the filing, we 
certainly didn't intend any disrespect. We do, you know, have 
to note our objections. And, of course, it becomes an awkward 
Situation to do so. And we do appreciate your understanding 
throughout this thing. 


c= 


But we also, frankly, understood that you may be 











seeking the Pro V&V evaluation, which the formal evaluation we 
just -- we don't have right now. They have completed the 
evaluation. The written report is not done yet. 

MR. RUSSO: That's right, Your Honor. That was in 
our filing yesterday. And we didn't -- you know, we expect 
that report -- to have it by the end of the week. 

To the extent there is any delay from Pro V&V getting 


us the report, we just didn't want, you know, there to be 


any -- any misunderstanding about a delay if we made that 
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1 representation. But we do expect it by the end of the week, 


2 and we will file it upon receipt. 





3 In terms of the EAC issue, you know, the order said 





4 to file -- to file anything that is filed with the EAC, 








2 presuming a filing is made with the EAC. Dominion actually 





6 does -- Dominion would make the filing with the EAC, not the 





7 State. And Dr. Coomer can speak to that. 





8 But there appeared to be some misunderstanding in 
9 counsel's email yesterday regarding the EAC filing. But to 


10 be -- to be clear, we -- since it has not been filed yet, we 





Ld didn't have any update for you. But that is a Dominion issue, 
12 not a Secretary of State issue. 

13 THE COURT: Well, it is obviously the responsibility 
14 under the state law still though for you to have an 

1D EFAC-certified system. 


16 MR. RUSSO: Well, Your Honor, I mean, the update is a 








17 de minimis update. So that is according to Dominion. 





18 In terms of what state law requires and what state 








19 law doesn't require, I mean, there is not a claim in this case 
20 regarding our compliance with state -- with state law. The 
21 only state law claim that was in this case was abandoned by 


22 plaintiffs earlier and dismissed in Your Honor's order on the 





23 dismissal a couple of months ago. 
24 THE COURT: All right. Let me just put it this way. 


25 I mean, it is an indicia of -- it is an important indicia of 
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what 1s going on and is this -- and from an evidentiary 








perspective certainly relevant. 








So I would -- you know, I went back at least and 
looked at the most recent regulations issued by the EAC. And I 


didn't see it as not being a requisite step to -- even a 





software modification as being requisite. Maybe I will hear 








differently from Mr. Coomer or Dr. Coomer -- excuse me. And 








Dr. Coomer is welcome to address at this point where things 


stand. 





DR. COOMER: Good morning, Your Honor. This is 





Dr. Coomer. Yeah. So I'll try to describe the process again. 
So we identified this change. And it was our feeling 

that it was de minimis. But we do not make that determination 

ourselves as a company. 

So the way the EAC process works is we submit that 


change to an accredited laboratory, in this case Pro V&V. They 





analyze the change. They look at the code. And they determine 
whether it is de minimis or not. 

If it is de minimis, then they do whatever testing 
they need to do to prove the nature of the change and verify 
it. And then they label it a de minimis change. They write a 


report. And at that point, it is just submitted to the EAC as 


what is called an ECO, an engineering change order. 


P =4 


So there is no new EAC certification effort. It is 











Simply updating the current certification for this ECO. And 
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that is what we -- 








THE COURT: I'm sorry. ECO? I'm sorry. 





DR. COOMER: ECO, engineering change order. And this 
is a software ECO. And that is how the process works. 


So once Pro V&V has the final report, we will submit 








c= 


that to the EAC, Election Assistance Commission, certification 
as an ECO, engineering change order, for the current 
FAC-certified system, the 5.5-A. 


THE COURT: So the November 15 clarification -- 





notice of clarification from the EAC that indicates that a 
proposed de minimis change may not be implemented as such until 
it has been approved in writing by the EAC, that is 
meaningless? That is Provision 3.4.3. 


DR. COOMER: I have got to be honest. We might be a 








little bit out of my bounds of understanding of the exact rules 
and regs there. 

THE COURT: And Mr. Maguire, as counsel for you -- it 
looks like he is present. 


MR. MAGUIRE: Yes. That's correct, Your Honor. 





THE COURT: Is that said at all? 











MR. MAGUIRE: I'm sorry. I'm unprepared to address 
it, Your Honor. 


THE COURT: All right. That is fine. I didn't ask 








you to be prepared. I just wanted to -- in case you wanted to, 


I wanted to give you that opportunity. 
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MR. CROSS: Your Honor, if it is helpful to you, 





c= 


Mr. Skoglund -- this is an area of expertise for him. 


Your Honor has hit the nail on the head, which what 





Dr. Coomer's explanation left off was once that EAC paperwork 








c= 





goes in you still have to wait for approval from the EAC. The 


EAC has to agree that it is a de minimis change and that it can 





operate under the existing certification. 





If they disagree, then you have got to get a new 
certification. But until that is approved, you do not have EAC 
approval to proceed. And Mr. Skoglund can explain that in more 
detail. So right now they would be proceeding without EAC 


approval. That is where we stand. That should be undisputed. 





THE COURT: Maybe that is what they have determined 








they must do. But I'll let Mr. Skoglund briefly discuss it. I 
mean, I think it is sort of evident. 

But, Mr. Skoglund, can we -- thank you. 

MR. RUSSO: Your Honor, one quick point. O.C.G.A. 


21-2-300(a) (3) is clear that the equipment has to be 


EFAC-certified prior to purchase, lease, or acquisition. The 





ongoing EAC certification that is now being raised, that is not 
in the statute. But Mr. Skoglund can go ahead and explain the 
rest of the process. 

THE COURT: All right. And I'll get back to you, 
Mr. Russo. 


MR. SKOGLUND: So I would just agree with what has 
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1 been represented already. That is correct. You void your 





2 certification if you don't have written approval before making 
3 this change. 


4 So the correct process is to go to the VSTL, then go 








3) to the EAC, have them review it. They are the ones who make 
6 the determination of de minimis based on the recommendation of 
7 the VSTL. But it is really up to them to decide that. And 


8 then they are the ones who bless it as being part of the 





9 certification. 





10 THE COURT: Either Mr. Russo or Dr. Coomer, is there 


11 any -- has there been any type of contact at this point with 





12 the EAC to say you are in emergency circumstances? 











13 DR. COOMER: This is Dr. Coomer. I don't -- I don't 





c= 


rom Pro 


14 believe so. But we were waiting for that final report 





15 VéV. And then that would be immediately submitted to the EAC. 





16 MR. RUSSO: That's right. The Pro V&V report -- 





17 THE COURT: I'm sorry. Who is speaking right now? 


18 MR. RUSSO: Vincent Russo. 





19 THE COURT: All right. I'm sorry. We've got a lot 


20 of people here. 





21 MR. RUSSO: No problem. The Pro V&V report or Pro 
22 VéV has indicated it is a de minimis change. So as 
23 Mr. Skoglund mentioned, the EAC will take that report and that 


- 


24 recommendation and proceed from there. 








25 But, again, we will file that report with you. And 
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Dominion will move forward with its piece in reliance on that 


report. 








MR. MILLER: Your Honor, I do also just want to point 


out briefly that, you know, EAC certification is not 





necessarily across the board. There are other states that 


don't have EAC-certified systems. Of course, we're still 





seeking to -- Dominion is still seeking to obtain the 





certification. But I did just want to point that out for the 
Court as well. 

THE COURT: This is a -- obviously, it is a provision 
the EAC has because it is -- no matter whether you call it de 


minimis or not, it always obviously raises issues when you 





change a piece of software and then you have to redo 


everything. 





You are obviously all doing testing, and I am glad 
that you are doing the testing. But the fact that you could be 
in a place that doesn't require anything is one thing. But, 


you know, we are using a statewide system. So it has larger 


repercussions when you have a statewide system also. 


All right. And so the software -- the new software 
is supposed to be distributed today. And what is the schedule 
from -- since you have said you are going forward even without 
the EAC approval or without seeing the actual testing 
documentation, what is your next plan? What is going to happen 


next? 
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MR. MILLER: Your Honor, it was distributed 








yesterday, I think, with the dropoff. And which also I do want 
to briefly mention, you know, we sent an email about the 
confidentiality of the dropoff process. 


At this point, that is no longer confidential. It 





was the prior to -- you know, it is a schedule of secure 


transfer of files that was filed on the public docket. And so 








that is the issue. I did just want to make sure we don't have 
a loose thread there. 

But in terms of the process next, the counties will 
begin engaging in that logic and accuracy testing that was put 


on pause after the last issue was discovered. And so we 





started that. The counties will also verify the hash value on 
the software that was given to them, which has already been 
verified by Pro V&V, the hash outside of the system at the 


Center for Election Systems, and additionally a hash again 





outside of the BMD system before those software was copied to 


the drives that were sent to the counties in sealed 


envelopes -- sealed, numbered envelopes via the post-certified 





investigators connected with the Secretary of State's office 
who met their county liaisons at Georgia State Patrol posts. 
That was -- 


THE COURT: What was verified at the Georgia State 


MR. MILLER: That was where the transfer occurred. 
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Hi So when the software was received -- you know, Pro V&V 





2 conducted their verification and validation, provided the 
3 trusted build hash to the Secretary's office. The Secretary's 


4 office then compared that trusted build hash to the hash of the 





2 actual software they had received outside of the BMD system. 


6 You have heard here before the concept that the BM 











7 can trick you into saying that the hash is verified. But, 

8 again, this is wholly outside of the system such that that 

9 is -- that is a separate issue entirely. 
10 After that delivery to the counties, the counties 
11 will also verify the hash and will then conduct their logic 
12 accuracy testing. 


13 THE COURT: All right. All I was asking was when you 





c= 


14 said something was verified when they picked it up at the 





1D Georgia State Patrol. 
16 That was just the sealing -- the seal of the 


17 envelope? 





18 MR. MILLER: Your Honor, yes. So the envelope was 





19 sealed by -- right, was sealed by the Center for Election 








20 Systems. And then the investigators of the Secretary's office 
21 met county superintendents at Georgia State Patrol posts. 


22 THE COURT: Okay. That's fine. Have you in any way 





23 expanded the scope of your logic and accuracy testing in light 
24 of these circumstances? 


25 MR. MILLER: Your Honor, so I think -- I guess 
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1 would separate it out briefly in that the Center for Election 


cs 


2 Systems conducted their own sort of modified logic and accuracy 








3 testing, which I referred to earlier as logic and accuracy 


4 testing within CES, on BMDs that they themselves had that have 











ie never been used in elections to verify that -- first of all, 





6 that that same issue was not recurring but also to continue the 
7 logic and accuracy testing such that -- to confirm that there 

8 were no ancillary issues brought in to do so. 

9 At the time it is sent to the counties, the counties 


10 will then conduct their logic and accuracy testing, which now 





11 also includes before inserting anything into the BMD verifying 


12 that hash number, verifying it is the correct software. That 





13 is kind of the initial step, which I believe -- I don't have 








cs 


14 the letter in front of me. But we laid out kind of that first 








15 couple of steps of the logic and accuracy testing. 





16 THE COURT: All right. But you haven't decided at 





17 this juncture -- to your knowledge that there have been no 


18 change in the logic and accuracy testing protocols or just 





19 going from one electoral race to the next in the machines so 
20 that you don't do the entire ballot on every -- on a larger 
21 number of machines in each of the counties? 

22 And that is the process you-all described, one race 
23 for one and then round-robin. 


24 MR. MILLER: And I'm not sure I can speak to any of 








25 the -- any detailed adjustments. What I will say is the 
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testing that was done within CES included five different ballot 





styles that were chosen from Dekalb County being a county that 





would have large ballot styles -- basically, you know, a number 





of races, number of different types of ballots on there. And 











- 


then they were conducted on those different styles and also 





Fag! oy 


conducted on the four different machines and printing out 





basically hundreds of ballots to confirm the testing. 














THE COURT: Well, as far as you know, there has been 
no -- no one has considered trying to test a larger range of 
the ballot -- the full ballot ina larger range of machines as 
testified to in -- at the hearing and which was the protocol 
that Mr. Harvey indicated was the protocol in his testimony? 


Is that right? 

















MR. MILLER: Your Honor, as I understand it, the full 
ballot is tested on all of the machines. 

THE COURT: That wasn't his testimony. The testimony 
was -- is that one race -- you picked a race. You went to the 
next machine, and it would do the next race. And then you 


would -- if you exhaust the race, which in Georgia you probably 





wouldn't exhaust the race, you would start with the next one -- 


if you had 12 machines, you did the 12 first races. Then you 


would go back to Number 1 machine, and you would go -- and it 





would do the 13th race. Then it would go to Number 2 machine, 
and it would do the 14th race. 


That is what I'm getting at. So that, really, you 
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have a fraction of the machines that are actually doing the 
race at issue. But it might screw up other races. So that is 
really what I'm trying to get at. 

But it doesn't sound like there have been any change 
in the process, in any event, from what you know. 

MR. MILLER: Your Honor, I would defer to the 
testimony and the written instructions on logic and accuracy 
testing. But yes. To answer your question, I couldn't comment 
as to any sort of very specific minutia within that. 

THE COURT: All right. I'm really not asking you to 
testify yourself as to it. 

As far as you know, no one has indicated to you that 
they changed any of the -- 

MR. RUSSO: That's correct, Your Honor. As far as we 
know, the process is the same as Mr. Harvey has discussed 
previously. 

THE COURT: That's all I'm trying to get at. 

MR. RUSSO: You know, with respect to printing the 
ballots and each race that we discussed at the hearing, that 
hasn't changed. The only change is with the logic and accuracy 
testing are to ensure that the hash value -- check the hash 
value of the new software and the version on the front end. 


THE COURT: And does Dr. Coomer know what was -- what 





type of testing was done on the software at PV&V? 
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THE COURT: When did they complete it? 

DR. COOMER: I believe they completed that either 
late Monday or Tuesday. 

THE COURT: Do you know who was performing the 
testing there? 


DR. COOMER: The individual employees' names, no, I 


THE COURT: I mean, is there a head of the unit that 
deals with security or not at this point? Because we had very 


vague testimony of that at the hearing. 


THE COURT: And do you have a backup plan in case, in 
fact, there are issues that are arising in connection with 
this? I mean, you are hoping for the best. You are thinking 


the best will occur. But what -- if there are issues again, 


what is the plan? 


DR. COOMER: We'll work with our -- we'll work with 
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our partners at the State to do whatever is necessary. 

MR. RUSSO: Your Honor, this issue, as you recall, 
came up as a result of this U.S. Senate special election having 
too long of a -- too many candidates and the Secretary of State 


not wanting to have any candidates claim that they were 





unfairly treated by being on the second page because surely 
someone would say that by being on the second page they lost 


votes. 





We are not aware of any other issues with the BMDs 
that would change, you know, the processes going forward. I 


mean, Mr. Barnes conducted logic and accuracy -- his logic and 





accuracy testing -- his acceptance testing I should say -- on 


the machines. 





The machines will go through acceptance testing. 


anything new is discovered in that process, we'll, of course, 





have to address that. But we have no reason to believe at this 
juncture there is anything new since this issue with the 
ballot -- the number of candidates being on one screen has been 


resolved. 





THE COURT: Dr. Coomer, did you get an opportunity to 





read Dr. Halderman's affidavit that was filed that if it really 


was just simply only the first time ran on a machine why 





wouldn't it have been adequate essentially to address this by 








just basically running it the first time? 


DR. COOMER: Well, so there is a 
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mischaracterization -- I'm not sure where that came from. So 
did not have a chance to -- 

THE COURT: Uh-oh. Everyone put themselves on mute, 
and we'll try to -- 


DR. COOMER: So I didn't read -- I didn't have time 














to read the entire declaration. But I will say that -- and not 





to disparage Dr. Halderman whatsoever. But he is making 
assumptions when he does not have an understanding of the 


actual issue. 











i had time and charts and I could work ona 














whiteboard, I could explain exactly what the issue is. But it 





is not that it happens the first time. I said that it only 


happens once -- can -- not that it always does -- but can 





happen only once during a voting cycle. And that is a power 





cycle of the machine. It is a rare occurrence that based on -- 
not just the ballot layout but, you know, the sequence of how 
the voters have gone through the ballot. 


There are essentially some indexes that are created 





by Android operating systems. And we have an index that we are 


referencing. And if there is a collision between those two, 





the issue happens. And it can only happen once because Android 
keeps incrementing these indexes. 

So it can only collide once. And there is a very 
specific set of circumstances that leads to this collision. 


And it doesn't happen every time. 
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Our analysis showed us how to actually reproduce that 








deterministically. So I have seen some other things -- I'm not 





sure if it was in Dr. Halderman's declaration or not -- that we 


didn't understand the root cause of this and it was 





undetermined how and when this could happen. And those 
statements are not correct either. 


So this is why we felt very confident in this change 





because it is very minimal. Instead of referencing this 











particular ID, we reference it now as what is called a tag. 
There is no collision possible between our tag and these 


Android IDs. 








And then just to hit on this point, you know, asking 
what if something else happens, well, this version -- you know, 


the certified version that is being used in Georgia has been -- 


has been used by millions of voters across the U.S. 





This is the first time we have seen this issue. And, 
again, it is due to the unique layout to handle the special 


Senate contest with the two columns of candidates. 





So I just wanted to sort of make that known. You are 
still on mute, Your Honor. 

THE COURT: Can you explain to me what the -- to make 
sure I don't misunderstand what you mean by power cycle, is 
it -- basically it could happen every time that -- is it when 
you turn the power on and then the next time when you turn the 


power on? 
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DR. COOMER: Correct. Yeah. When you turn the power 





off and you turn it back on, Android starts those indexes back 
over. 
THE COURT: All right. Then does it happen each time 


just in the beginning or any time in the cycle? That was the 





other part that was a little confusing to me because I had 
thought you indicated before or somebody had indicated it was 
right at the start of the cycle. 


DR. COOMER: No, it is not right at the start. 





Again, it depends on a variety of factors. So, you know, it 


depends on the number of -- the number of display elements that 





cs 


are on the ballot itself and how the voters walk through. 








So it could be -- it could be several voters. And, 





again, it doesn't happen all the time because you have to have 
this unique overlap, you know. And that is wholly dependent 
on, you know, the sort of behavior of the voters going through 
the ballot of whether they just happened to hit on this unique 
circumstance. But it is not -- it is not necessarily within, 
you know, X number of voters. 

THE COURT: Okay. And it is not -- so if you -- it 
is not dependent on the fact that this is the first time 


P 4 


you've -- it is not the first ballot in any event? 





DR. COOMER: COrrEects 





THE COURT: It is not the voter who gets -- who is 





the first one in line who gets it necessarily? 
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DR. COOMER: Correct. 








MR. CROSS: Your Honor, could I ask a quick 
clarifying question? 


THE COURT: Yes. 








MR. CROSS: I just want to make sure I understand. 





On Monday, Dr. Coomer said -- he said this happens only once 


for one voter during a complete machine cycle. That was where 





Dr. Halderman's understanding was coming from. 


So is it right that it is not just once for one voter 





during a machine cycle? It could happen more than once? 





DR. COOMER: No, not during the machine cycle. When 








say machine cycle, I was referring to power cycle. So it can 








only happen once. 





MR. CROSS: So then why is Dr. Halderman wrong? Why 


couldn't you just power it on? 








DR. COOMER: Because once is not the same as first. 


(Unintelligible cross-talk) 


MR. RUSSO: We are here to answer your questions, 


laintiffs can go do discovery if they would like to. 











P 4 


Tor now. 





iscovery. So you can continue to answer 





id want to raise that before we -- 


THE COURT: I think -- Mr. Russo, I appreciate that. 








But it was -- I certainly had the impression that Mr. Cross did 








too. So I'm very happy that Dr. Coomer is explaining it. 





So if Mr. Cross had a misunderstanding too, then I 
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think he is entitled to try to -- 





MR. RUSSO: And that is fine. I just wanted to make 


c= 


sure before we got too far down this road that I raised this. 











THE COURT: All right. 








MR. CROSS: So, Dr. Coomer, all I was asking you: 
will happen only once in a power cycle, but you don't know whe 
it will happen, meaning you couldn't just do a single test 
ballot? You would have to do test ballots until it happened 
the one time and then you -- 


DR. COOMER: Right. And, again, to be clear, it 








doesn't always happen. Right? It is this unique way of going 





through the ballot. So you could -- you could say, oh, I'm 





going to wait until this happens and it never happens because 


you have passed those conditions. 


MR. CROSS: Got it. Okay. Thank you. That is 





really helpful, Dr. Coomer. 








DR. COOMER: Sure. 





THE COURT: So -- and maybe one has to have 
Mr. Barnes here or someone else from the department present. 
So I'm just trying to understand how the logic and accuracy 


testing that is being performed at this juncture mirrors 





that -- those conditions since it is not necessarily the first 
time it has been done. 
What were -- what are the instructions to make sure 


that it doesn't happen, partially because, you know, the point 
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really is the size -- the vote should be counted proper] 











you just don't -- it could -- there are repercussions if 
does in terms of people getting confused at the polls and other 


sorts of problems that can happen there that it triggers -- the 





people are worried about their votes and one comes to a halt, 





et cetera. 





MR. CROSS: Your Honor, could I ask one more 


question? 





Dr. Coomer, you mentioned that you could do -- you 
figured out a way to do it deterministically, which means you 
could trigger it. Would that work to -- rather than doing new 
software, could the counties trigger it using this 


deterministic approach? Then you could trust it wouldn't 


happen again with the existing software. Would that be a fix? 


DR. COOMER: I mean, that is -- theoretically, that 








is possible because it depends on, again, a lot of variables. 





So each -- you know, obviously each county and each machine 
has -- may have a different set of ballots on there. 

So like -- so what we did is -- obviously, this was 
identified in two counties. And we know the ballot styles that 
they were testing in those counties. So we zeroed in on that 
and found a way using those two projects how to make it happen. 

We would have to do that for every machine in every 


location because it is dependent on the ballots that are in 





that machine to then want to determine whether you could make 
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IDs collide. 











Does that -- does that clarify? That would be, 


again, theoretically possible. A nightmare. And then that 





whole process would have to be done every time the machine 1 
turned on. 

THE COURT: Let me start this way simply: You-all 
did some logic and accuracy testing yourself when you were 
trying to do the software modification? 


DR. COOMER: Oh, extensive testing. Extensive. 








THE COURT: All right. How did you modify -- how 





29 


Ss 


did 


you do it so that -- in light of these circumstances in terms 





of the protocol so that you would -- it would be at least 


randomly captured? 





DR. COOMER: Right. So -- well, the first thing w 
did is obviously analyze the projects where it was -- where 
issue arose. And that led us to figuring out what the root 
problem was. 


Then our initial testing was we actually set up a 





quick project where -- knowing how the code behaved we knew 
exactly the steps to take within a few clicks to make this 


issue happen. Right? And so we set that up, verified on 


multiple machines that we could make it happen according to 


step A, B, C. 
So then we applied the change and then redid those 


steps, verified that that issue no longer arose, and then we 
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took that back to, you know, the actual -- some of the actual 








real Georgia elections that would be tested and ran full 
regression tests over several days to verify that nothing else 
was impacted. 


THE COURT: You ran full regression tests to 





Cc 


determine what? I didn't hear the last part of your sentence. 








DR. COOMER: That no other functionality was 





impacted. 
THE COURT: So have you made any recommendation to 


the State regarding any additional measures that should be 





C= 


taken in order to test the functionality of both the fix as 


well as that it didn't impact anything else? 








DR. COOMER: So I don't -- I don't know all of the 








information that was communicated to the State. But I believe 





we did -- again, as I mentioned, we had those two counties 
where we -- you know, where the issue was experienced. We know 


how to make it happen in those two counties. I believe we 


provided those steps to the State for verification. But, 


again, I'm not the one that is actually communicating the 
operational aspects directly with the State. 

And then as far as the other functionality again, the 
pre-logic and accuracy testing process we feel is enough to 


Lf 


verify that the system as a whole is still functioning as it 





should. 


THE COURT: Let me just say that in your testimony 
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before this Court you indicated that you had not been aware 


that -- that the full ballot had been tested in each machine. 








So I guess would it be wise to have more of the full 





ballot tested in every machine? I mean, for instance, among 


other things, this particular race? 














DR. COOMER: I'm not sure -- I'm not sure I'm 


following. But, again, you know, the logic and accuracy 








testing that I'm aware of from the State I believe is adequate. 





THE COURT: I don't want to get into a 





cross-examination with you myself about that. But you do 
understand that there is only a small fraction of the machines 
each that are tested for -- for instance, as to this particular 
race that are going to be out in the field? 


DR. COOMER: Again, I don't -- I don't know every 











single detail of the L&A that they are doing. 


THE COURT: All right. That is fine. Then we'll 
just -- we'll stop at that then. 
Mr. Russo and Mr. Miller, is there anyone who is 


PJ 


familiar with the -- what the instructions have been to the 





field with the State available just to talk for -- speak for a 


minute or two? 





know Dr. Coomer has to leave in four minutes. So 





before we do that, I want to make sure that there is not 





anything else that counsel wish for Dr. Coomer to address. 


MR. BROWN: Your Honor, this is Bruce Brown. I have 
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one question for Dr. Coomer. 
Our information is that the version of the software 
that was certified was .30 and the current version is .32. 
What was .31, and what is .32? And have the 
incremental changes from the various versions been tested, 


certified, or approved? 





MR. MILLER: Your Honor, we're just going to raise 


the same objection earlier as far as cross-examination of the 








witness right now. 


THE COURT: Well, I think it is -- 








DR. COOMER: Version numbers change for a variety of 





reasons. I'm not even sure what that question is trying to get 
at. 
THE COURT: Well, it is trying to understand if there 


have been software change or some other change between the 





5.5-A, I guess, .30 and 5.5-A.32, which this is. In other 








words, what happened -- do you know what was .31? 


DR. COOMER: There is absolutely no other change than 





the one we supplied that we alluded to. 


MR. BROWN: So why are there two version numbers? 





DR. COOMER: There is not two version numbers. There 
are a variety of reasons why when you do a build a version 


number turns out the way it does. 





I don't know what you are digging at. But I can tell 





can state as fact -- and I just did -- that the 
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TILLER: Your Honor -- 








DR. COOMER: -- between those two builds is this 
change that we submitted. 

THE COURT: All right. 

MR. BROWN: So there is not a version 31? 


(Unintelligible cross-talk) 








MR. MILLER: Your Honor, we just reraise the same 








objection. Dr. Coomer is here voluntarily right now. Dominion 





is not a party to this. He is trying to be helpful to the 
Court. And we are going down a path of cross-examination 
again. 
CROSS: Why are they scared to answer questions? 
COURT: All right. No more commentary, let me 


understanding -- 





COOMER: I'm not scared to answer your questions. 





COURT: 11 right. 





MR. CROSS: I wasn't talking to you, Dr. Coomer. 





THE COURT: My understanding just from what 








Dr. Coomer said was very -- there were a lot of people 





speaking -- is that Dr. Coomer said that there was no separate 


change from the 5.5-A that has been made so that there is -- to 





the extent the other one had a .30, there was no .31 separate 
change. 


DR. COOMER: That's correct. 
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THE COURT: Is that correct? 





DR. COOMER: That's correct. 





THE COURT: All right. Fine. Thank you. 





anything else? 





All right. Doctor, you are welcome to stay as long 





as you want to stay. But I understood that you had a hard 


deadline. 











DR. COOMER: I do have a hard stop, and I 
appreciate that. 


THE COURT: All right. Thank you very much. 





MR. CROSS: Thank you, Dr. Coomer. 





THE COURT: Is it Mr. Barnes who is giving directions 
to people in the field about the L&A testing at this point? 


MR. RUSSO: I think Mr. Barnes would be the best 





person to try to answer your questions. He is involved with 





the development of logic and accuracy testing. 





THE COURT: All right. Is he -- 
MR. RUSSO: We're going to -- if you can give us one 
minute here to get in touch with him. 


THE COURT: That is fine. 


(There was a brief pause in the proceedings. ) 


THE COURT: Good afternoon, again, or good morning. 


Morning, Mr. Barnes, also. 





just -- we were discussing the circumstances around 


the software being distributed and subject to logic and 








UNITED STATES DISTRICT COURT 
OFFICIAL CERT ED TRANSCRIPT 



































za 














Case 2:20 a8e18134cUW2F8S\WT EDBcmEhil85 Pag eed 20/E9RO 1 PAGeT7 BabA 7 of 119 





SEALED TRANSCRIPT 35 














accuracy testing again. And I wanted to find out whether there 








were -- to your knowledge, whether there were any additional 
instructions about conducting logic and accuracy testing that 
was given to any -- all or any of the counties relative to the 
software. 

MR. BARNES: The one additional instruction was for 


the counties to verify the new hash signature for the new 





version number of the ICX application. 


THE COURT: And therefore am I to assume that there 





were no -- there was no other modification and in particular 





there was no expansion as to the number of the ICX machines 
that were going to be tested for purposes of looking at that 


race in particular or any other races? 





MR. BARNES: Again, we did not give them another list 
of instructions to follow for their L&A testing. Part of their 


normal LéA testing is to check every vote position on every 


ballot as they go through the ballot style. And that is how 


the occurrence was found with the old version. So we were just 
going to have counties follow the same protocols with the new 
version. 

THE COURT: Mr. Harvey had confirmed before though 
that the instructions were that you would run the ballot -- 


let's say -- let's -- just consider that there were ten 





machines, let's say, that were being tested. That you would 





run race Number 1, which would presumably be the presidential 
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race, on Number 1 machine. Then you would run race Number 2 in 


priority on machine Number 2. And when you had finished the 





ten, then you would go back -- the 11th race would be tested 


again -- would be tested on the machine Number 1 again. 





Is that something different than you know of? 

MR. BARNES: No. What my understanding of the Lé&A 
procedure is is the ballot is loaded on to the L&A -- on to the 
test screen ballot. And then the first race of the ballot is 
displayed. And then on that race, they will mark each -- they 
will touch the first candidate, validate that the mark is 
there; proceed to the next race on the ballot; mark the 
candidate, make sure it is there; and proceed all the way 


through the ballot until they arrive to the summary screen. 


And they validate that they see those selections on the summary 


screen. 

They then backtrack. Go back to the first race in 
the ballot, remove the mark from the first candidate, and then 
mark the second candidate in that race and proceed through the 
ballot again all the way through the summary screen. 

And this is done to make sure that every vote 
position is responsive and that the system shows that summary 
selection at the end. They will produce one printed ballot 
through that exercise with at least one of those candidates per 
contest marked. But they won't produce a ballot for every 


instance, for every candidate in every race on every machine. 
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They will just produce one printed ballot at the end of that 





test of that particular BMD. 

THE COURT: And have you looked at the instructions 
that were given in January via Mr. Harvey's office? 

MR. BARNES: Yes, ma'am. 

THE COURT: And that is what you think is consistent 
with what -- what you have described is consistent with the 
protocol described? 

MR. BARNES: Yes, ma'am. 

THE COURT: Well, let me walk through it again. 
Because that certainly was not my understanding from the 
testimony provided or from the observations that were provided 


by people at the -- observers at the polling. 





So I'm not -- so you are saying basically the member 


of the staff who was testing it will go in and vote on the 








presidential race? And just walk me through it again so I can 





stop you now that I have heard the whole -- what you think is 
supposed to happen. 

MR. BARNES: Okay. So we'll take it as a single 
race, Single -- single ballot, single race. And we will say 
the presidential race, which has four candidate options. 

On the testing, they would load the ballot, bring up 
the contest that shows the four -- the four contestants. They 
will mark the first contestant and then leave that screen and 


go to the summary screen to validate that that mark is showing. 
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They would then go back to the race itself, remove 
the mark, and then put a mark for the second candidate and then 
proceed back to the summary screen, confirm that that is 
showing. Go back again to the ballot, remove the mark, mark 
the third candidate in the race, proceed to the summary screen, 


confirm that is showing. And then go back to the race, remove 





the mark of the third candidate, put a mark for the fourth 
candidate, which is the write-in, type in some form of a name, 
proceed to the summary screen, verify again that that is 
showing. 

Then they would backtrack, go back to the race 
itself, remove the mark, go to the summary screen, verify that 


that mark again is not showing. Then go back to the race. And 


now they are going to put a mark on the ballot so that they can 


c= 


produce a printed ballot from the machine. 





And they may select the first candidate or second 
candidate or third candidate depending on what they are needing 


to produce for their test deck. So they may do the first 





candidate and then proceed back to the summary screen and then 
print the ballot. 

THE COURT: So is the printed ballot the one with all 
of the choices? 

MR. BARNES: The printed ballot will only have the 
one selection made at that last operation. The ballot can only 


have one mark for the race. 
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THE COURT: I don't -- because I don't know 








whether -- is anyone with you from -- are you able to receive 





an email if I send counsel the L&A procedure -- January 


procedure and they sent it to you at this point? 





MR. BARNES: Yes, ma'am. I have access to email. 


THE COURT: I don't want to be the person directly 





sending it to you. But -- all right. But if counsel doesn't 
have it directly offhand, Ms. Cole can send it to one of you 
right away so you can send it on. 


Send it both to Mr. Miller and Mr. Russo. 





LAW CLERK COLE: Okay. I can also send it to Harry, 
and he can share it on the screen. 


THE COURT: Okay. Why don't we do both? Why don't 





we send it because it is harder for -- let's do both and give 


Mr. Barnes an opportunity to look at it. All right? 


(There was a brief pause in the proceedings. ) 





MR. BARNES: I haven't received anything as of yet. 
LAW CLERK COLE: Mr. Martin has it now if you want 
him to share his screen. 


THE COURT: I want Mr. Barnes to be able to review it 





without having to see it on the screen first. 


MR. RUSSO: My email might be running a little slow. 





IT emailed it. So it is just a matter of -- 


THE COURT: That is fine. 











Ms. Cole, can you pull up Mr. Harvey's affidavit 
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1 

2 CLERK COLE: Yes. 

3 . RUSSO: Do you know what docket number that is? 
4 COURT: Well, the affidavit? 

iS) . RUSSO: Yes, ma'am. 

6 CLERK COLE: My recollection is it is 834-3. 

7 MR. RUSSO: Thank you. I was just trying to look 

8 through the transcript for that explanation. I was not finding 
9 it. I appreciate that. 

10 MR. CROSS: Do you mind forwarding that document that 
11 Ms. Cole sent you so that I can pull it up too? 

12 MR. RUSSO: Yes. 

13 . CROSS: Thank you. 

14 COURT: Does everyone have the procedure? 

15 . Barnes, you don't have it still? 

16 . BARNES: No, Your Honor, I do not. 

17 COURT: Mr. Russo, did you send it? 

18 . RUSSO: I did. Let me try again. 

19 COURT: Okay. Very good. 
20 . MILLER: JI think we both actually sent it. 
21 COURT: All right. 
22 (There was a brief pause in the proceedings. ) 
23 COURT: All right. Mr. Barnes, did you get it 
24 
25 . BARNES: Yes, Your Honor. I just received it. 
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THE COURT: Very good. Let me give you an 





opportunity -- I'll give you the opportunity to read the 


portion that deals with the process for looking -- testing the 





polling place scanner, that one -- I'm sorry -- right above it, 





testing the BMD and printer. 


And have you had an opportunity to look at that, that 





Section D? 





MR. BARNES: Yes, ma'am. I'm reviewing that. 


(There was a brief pause in the proceedings. ) 


MR. BARNES: Your Honor, I've read it. 





THE COURT: Thank you very much. So my understanding 


both from Mr. Harvey's testimony on this particular procedure 











and what the witnesses to the L&A testing observed when they 
were able to observe this in a -- because it was public was 
that the description provided in the text under -- in 


connection with the word example was what was occurring, that 





there was not -- every race was not in a particular ballot -- 








ballot machine -- every race that was listed on the ballot was 





not, in fact, tested on that one machine. That, in fact, it 
was -- you went from machine to machine as described under the 
word example. 

MR. BARNES: My -- excuse me. 

THE COURT: Yes. Go ahead. 

MR. BARNES: My reading of the document outlines that 


the ballot style will be displayed on, we'll say, machine one 
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1 and that the process of creating the ballot that is going to be 
2 used for the test deck for machine one would be that the -- 


3 that the operator would select the first candidate not for just 





4 one race but the first candidate in every race on that ballot, 





3) proceed through the whole ballot, and then at the end would 





6 then print that one ballot that had the first candidate 

7 selected. 

8 So that the machine one would have ballot style one 
9 and then it would have the selection of the first candidate in 
10 every race selected and print it. 


11 On the second machine, the ballot would be loaded. 





12 And then from that machine, the ballot that would be printed 

aS for the test deck would be the second candidate in each race. 
14 And then that ballot would be printed for the test deck. 

15 And then they would go to machine three, load the 

16 ballot. And on this one, the ballot that would be produced for 
17 the test deck would be the third candidate in each race within 


18 that ballot and so forth and so on. 





19 THE COURT: Well, that certainly is somewhat 


20 different than my understanding the testimony and evidence. 





21 And -- but I understand what you are saying. 
22 What is the -- so just to summarize again is that you 


23 understood that if I -- whoever was Number 3 in each race would 





24 have been picked -- if you were on the third machine, you would 


25 have picked Number 3 -- the candidate in the third position for 
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every Single race? 
MR. BARNES: Yes, Your Honor. 
THE COURT: And what if there wasn't a candidate? 


MR. BARNES: If there is not a third -- if one race 





has four candidates but the second race only has two 
candidates, then you do not make a selection at all. You would 
skip. There is not a third option to choose. So you would 
leave that race blank. 

THE COURT: Then you would continue down the ballot? 


MR. BARNES: Yes, Your Honor. 





THE COURT: JI think this is sufficiently a material 


change in the way that perhaps it has been presented. I'm not 








saying anything -- that you are wrong in any way or -- but I 








just think that I would like to make sure there is nothing that 


the plaintiffs want to ask in light of that testimony. 


And have you observed this yourself or not? 


MR. BARNES: I have not been in the field to observe 





the L&A testing with the new system, Your Honor. 

THE COURT: All right. So you haven't been in the 
field to observe their application of this procedure? 

MR. BARNES: That's correct. 

THE COURT: All right. 

MR. RUSSO: Your Honor, I pulled up Mr. Harvey's 
declaration, and I'm looking at that. And he seems to indicate 


that all -- that testing the ballots -- a test deck where you 
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use every permutation would be overly burdensome and 
unnecessary, as the Coalition plaintiffs urge, in other words, 
to generate test ballots so that all candidates in all races 


within the unique style have received a single vote. 








think maybe that is where some confusion is coming 





into play. And I think Mr. Harvey was under the impression -- 
and his declaration seems clear to me. But to the extent there 


c= 


is some confusion that maybe you thought every permutation on 





the ballot maybe had to run a test deck with every combination, 





is that -- and I'm just maybe trying to understand it also 


cs 


myself -- where the disconnect is here, frankly. 





THE COURT: Mr. Skoglund was, I think, the 
Coalition's witness or -- is that right? Or was he Mr. Cross' 


witness? 


MR. CROSS: Mr. Skoglund was a witness for the 


Coalition. 


THE COURT: Okay. 





MR. BROWN: I'm sorry, Your Honor. 
THE COURT: So I'm assuming that you spent some more 


time -- particular time on this, Mr. Brown. 





So are there any -- anything you want to point out or 
ask Mr. Barnes about? 

MR. BROWN: Thank you, Your Honor. My question would 
be, sort of to cut to the chase -- and that is: On the logic 


and accuracy testing as described by Mr. Barnes, all of the way 
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through tabulation, there is only one ballot that is actually 
tested and that the other testing that Mr. Barnes described was 


testing the accuracy of the summary screen rather than the 





accuracy of the final output. 





Is that correct, Mr. Barnes? 





MR. BARNES: What I was describing was the generation 
of the test deck that has to be generated at the end of the L&A 
testing. 


THE COURT: Wait a second. I think we should put 








ourselves on -- everyone but you on mute so that we make sure 
that we -- 
Go ahead. 


MR. BARNES: Again, what I was describing was the 





generation of -- it is two parts. It is the L&A test to 


validate display of ballot operation of the touchscreen being 








receptive to touch and then the generation of the record from 





each device that is used to organize the test deck that is then 
scanned by the scanner. 
So the tester wants to go through and look at each 


race on the ballot, make sure that all the candidates are 





displayed, make sure that all candidates are receptive to 
touch, and take that all the way to the end of the summary 
screen. And then they back out and continue that through all 
positions. 


But when they have completed that, they have to 
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produce a record. But they are only required to produce one 








printed record from that BMD. And then they accomplish to get 


all positions voted and a vote registered by doing the machine 





one, the machine two, the machine three through the ballot 
style. 


MR. BROWN: Thanks. 





MR. CROSS: Your Honor, could I ask a follow-up 


question? 





Mr. Barnes, did I understand you right so if you've 
got -- well, let's just take a concrete example. There is a 
Senate race this year that has, as we understand it, it sounds 


like 20 or so candidates. 











So that means you would generate a test ballot that 





has -- you would generate a separate test ballot for each of 
those candidates on however many machines correspond. Right? 


So let's say there are 20 candidates. You would 


generate 20 separate test ballots on 20 consecutive machines 


selecting each candidate in turn. 


Do I have that right? 





MR. BARNES: What you would do -- let's say that 
there are -- let's say that there are 20 machines. We'll make 
a balanced number. Let's say -- actually we'll say there are 
10 machines and there's 20 candidates. 


Then you will start with machine one, check all the 





races, check all of the candidates, make sure they are 
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responsive. But when you are done with that machine, at the 


end of that machine, you would select the first candidate in 





that Senate race and produce a ballot printout. 

Then you would go to the second machine. The second 
machine, again, you would check the full race, check all 
positions, check responses. But when you are done with that, 
you would produce one ballot from the second machine and that 
would have the second candidate. 

And you would repeat that process through those ten 
machines. When you got to the 11th candidate, you would be 


returning back to machine Number 1. And on machine Number 1, 





you would now select -- again, you have already looked at all 
of the candidates again already. So on that machine, you are 


going to produce a second ballot. And that second ballot is 


going to have the 11th candidate selected. 


And then you will continue to proceed in that manner 
until you have produced a record that -- a vote record that has 


every candidate in that race voted one time. 





MR. CROSS: And if you have got -- if the other 
elections have fewer candidates -- right? So let's say you are 
at candidate 6 out of the 20 and all of the other races have 
fewer than 6 candidates, at that point forward, you would not 
have any candidates selected on those races for the test 
ballots? 


MR. BARNES: That's correct. 
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MR. CROSS: So that would mean if we have got a race 
this year of, say, 20 or so candidates, you would have a pretty 
large number of test ballots coming out of machines that have 
no candidate selected for some of those races? 

MR. BARNES: That would be correct. 

MR. CROSS: Thank you. 

THE COURT: Just state that again, what you were 
saying, Mr. Cross. 

MR. CROSS: Because this year we've got a Senate race 


that has a large number of candidates -- it sounds like 20 or 





more -- and because once you get over -- say the next highest 





number of votes is -- I'm trying to think of the easiest way to 





say what I just said. 





Once you get over the next highest number of -- say 
every other race had two -- only two selections. Right? Once 
you get to the race that has three or more candidates, you stop 
selecting any candidates in all of those other races. You 
don't go back and just select one that you have already 
selected. 

So that means once you get to 3, 4, 5, 6, on up 
through 20-something candidates when you are testing it, all 
the other races on the ballot would have no selections on any 


of those test ballots for all of those machines. So you would 


be going machine to machine to machine. 





THE COURT: You are only going by position number. 
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2 MR. CROSS: So with this particular year with a race 
3 with that many selections -- you are talking a pretty large 








4 number of BMDs that would have test ballots with only a single 
ie candidate selected, which then gets printed and tabulated. 


6 Those BMDs would not have test ballots for candidates for all 





7 but one race. 


8 MR. RUSSO: I mean, there's always going to be 





9 elections where you only have maybe one person ina race. So, 


c= 


10 Mr. Barnes, that is what you would do, for example, if you had 





ieee a county commission race also on the ballot and you've got one 
12 person in that race. Right. You would put that -- you could 


13 check that person off the first -- on the first test ballot. 





14 But going forward -- I mean, there is going to be other 
15 contested races, of course. You know, maybe you have a house 


16 race, a state house race with three candidates. So you have 





17 got to go through those three times. But the county commission 


18 race with only one candidate would only have -- be selected the 








19 first time through. 
20 MR. BARNES: Correct. Correct. And if -- 
21 MR. RUSSO: We have had this happen in every 


22 election. 





23 THE COURT: Well, I'm not sure that really helps 


24 because, of course, when you have only a single -- a single 





25 individual then they are in position one. So they are going to 
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be tested -- those races are all going to be counted as 
position one. 


The problem here we have is position -- the fact that 





there might not be any others races that have Position 10 and 


so -- or Position 8. So that basically in the very race that 





sort of seemed to have -- on the ballot that had created a 
quirk, you are going to have the least amount of L&A testing -- 


ca 


that's all -- in terms of output. 





MR. CROSS: Well, yeah. I'm not sure that is quite 





right, Your Honor. Let me back up. 

They will test every candidate in that Senate race. 
So that particular race that has a large number of 
candidates -- right? -- that will get tested. 


What it means is that for all of those ballots 


cs 





beyond, say, the first three or 


our candidates, depending on 








what else you have there, there will be no L&A testing for any 
of those other races. 


THE COURT: Right. 








MR. RUSSO: Well, they are tested the first time. 





I think we are saying the same thing. 
MR. CROSS: No. No, they are not. What Mr. Barnes 


is saying is there is no ballot that will be printed at all 








from those BMDs that gets printed and scanned and tabulated 


that has any candidate selected from any race other than the 





Senate race once you get beyond the max number of candidates in 
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those other races. 





And given a lot of those races are only going to have 
maybe 2 or 3 candidates but we have got a race with 20 or more, 
you are talking about maybe 50 to 20 machines each time that 
are not having a single candidate tested to get printed and 


scanned and tabulated. 





MR. RUSSO: I understand what you are saying. But 
you would have had -- that person who is -- you know, if it is 
a race of three people, you would have had a test ballot that 
would have had that person -- the third ballot would have been, 
you know, in this example that you gave a race of three people. 


Now, when you get to person four -- Mr. Barnes can 











explain it. And if I'm wrong, I'm wrong. Mr. -- I'll let 


Mr. Barnes explain it. 


MR. CROSS: Because once you get to selection -- 











again, Mr. Barnes, I thought I -- let me just try my question 





again. I thought we had it straight. 
Let's say the maximum number of candidates on a 


ballot was 4. That is the most you have in any race is 4, 





except for you have got the Senate race, let's say, that has 20 
candidates. 

Are you with me? 

MR. BARNES: Yes. 

MR. CROSS: Once you get to selection five to test 


that, meaning printing a ballot and scanning it, in the Senate 
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race, you are going to do that and that ballot is not going to 


have any other candidate selected for the test ballot; right? 





MR. BARNES: On that ballot style. But when there 





are multiple ballot styles within the polling location, once 

















you complete ballot style one, you then have to do the same 
thing for the next unique ballot style within that -- within 
that polling location. So there is opportunity for more 
ballots to be generated with more selections. 

MR. CROSS: Right. But most -- particularly on 


election day -- putting aside early voting, on election day, 








most of your ballots -- most of your polls are going to have a 
single ballot style; right? Otherwise, you are talking about a 
polling site that has multiple precincts. 

MR. BARNES: There is -- every precinct in the state 


is different. Some only have one ballot style. Some have 





many. It is a potpourri out there. 


MR. CROSS: But with my example, you would have -- 





unless you are printing multiple ballot styles on that BMD, you 





are going to have selections -- you are going to have machines 
five through -- you are going to have 15 machines -- remaining 
5 to 20, you are going to have 15 machines for which your test 
ballot has only a single selected candidate just in that Senate 
race; right? 

MR. BARNES: The ballot that is printed for the test 


deck, yes. But every position would have been looked at on 
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1 that ballot during the examination. 
2 MR. CROSS: On the screen? 


3 MR. BARNES: Correct. 





4 MR. CROSS: And looking at the screen does not tell 
3) you what actually gets tabulated; right? 

6 MR. BARNES: The screen is the interaction and the 

7 intent of the voter. The ballot is what will be the official 
8 record. 

9 MR. CROSS: Right. So -- 
10 THE COURT: And the next step is, of course, the 
ieee scanner tabulator? 
12 MR. BARNES: Correct. 
13 THE COURT: And you can't really test that just from 
14 looking at the screen? 
15 MR. BARNES: Again, that is why we produce the record 
16 from the machine so that the scanner can also be used to 
17 validate that what is coming from the system is what the 


18 scanner then tabulates. 





19 THE COURT: I think that the -- I mean, I'm not sure 











20 that what is happening in the field is what you are describing. 





21 But, you know, I'm just -- based on what the evidence is and 
22 the way that Mr. Harvey described it but -- and why he thought 


23 everything else was too burdensome. 





24 But that is -- you know, I understand what you are 








25 saying at this juncture. I mean, I'm looking at my -- at a 
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sample ballot here. And -- and basically when we get down to 





number -- where we were actually thinking of four candidates, 


we get down to the fifth one, only one of the major leaders 





here who is in that first top four is Doug Collins. 


So all the testing that would relate to other -- 





identified at least by the polls leaders in this race are after 
Number 4. So testing of their -- any ballot, including them, 
would be -- it would be fewer. But that is if it is, in fact, 


the way it is indicated. 





I'm just looking at Paragraph 6 of Mr. Harvey's 





affidavit and also testimony. And I can't really know at this 


point that what Mr. Barnes describes based on the testimony and 





the evidence presented is exactly what is happening. 


But, Mr. Skoglund, did you get an opportunity to be 


present during any of the L&A testing? Remind me. 


MR. SKOGLUND: No, Your Honor, I have not been 








P= 


present for any of it. 





Can I offer a thought about this? 








THE COURT: Yes. 


MR. SKOGLUND: So I think that, as I testified 





before, you know, logic and accuracy testing depends on what 
questions you are asking. Right? And the quality of the 
question you ask depends on the quality of the test. So it 


really makes sense to think about what questions you are 





asking, what are you trying to find out. 
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And I think, you know, this is -- this is more logic 


and accuracy testing that some jurisdictions do. But I think 








that is not the standard. I think the question is: Does it 





meet Georgia statute, which I think is quite good and quite 





strong? I would go further, if it were me. 











think that the way I would do -- conduct a logic 





and accuracy test and the way I have seen other people do it is 





you create a spreadsheet essentially ahead of time with the 
test pattern for votes for what you plan to do. And in that, 
you try overvotes and undervotes and races where you vote for 
two and the audio ballot and trying it in Spanish language. 
And, you know, you try a variety of scenarios. 

And then, you know, knowing that you have good 
coverage in that spreadsheet, then you go to the machine and 


ask each machine to accomplish that set of tests. That is 





closer to what I think the Georgia statute requires. 





THE COURT: Well, I just would like to know what is 





actually going to be -- and whether everyone is going to be 
doing something different actually. That is my concern at this 
juncture but -- based on the evidence introduced. 

But the other thing was simply because this was the 


-- the alleged tweak that involving this particular ballot one 

















would really want to know it was -- all permutations of that. 








It is hard for me to know without -- what I do know 


is what -- the issue that Mr. Cross elicited. And it might 
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behoove the State to consider whether to modify at least this 
in a way -- whatever the process is, if it is, in fact, like 


what Mr. Barnes describes as opposed to the inference that was 








given from the procedure as I identified and witnessed by 


others who were watching the L&A testing in the last election, 





it really behooves everyone to think about is there something 
you want to beef up under the circumstances since you have a 


software change particularly affecting that race. 








can't really say more at this juncture. I'm going 





to go back and look. But there's really some material 





differences between the way Mr. Barnes described it and the way 


it was otherwise described. 





MR. MILLER: Your Honor, I don't have the transcript 





c= 


in front of me from the hearing, so I can't speak exactly of 





Mr. Harvey's testimony. 





But as far as the declaration and as I recall the 





hearing, I think the concept was the concept that Mr. Barnes 


described of the difference between printed ballots versus the 





test on the screen. And so I don't think there is -- 


(Unintelligible cross-talk) 





MR. MILLER: -- necessarily inconsistence there but 
different topics. 


THE COURT: Yeah. I mean, there is no question that 





it was supposed to be getting at the difference as to whether 





there was a difference between the way it tabulated and the way 
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Hi it printed and the ballot. 





2 But it was -- but it was much more helter-skelter 





3 because -- as opposed to just testing one office per machine 


4 and sometimes more depending on how large the ballot was. So 





2 that -- I mean, that is exactly what -- not just through 

6 Mr. Harvey's testimony but through the affidavit of people who 
7 were witnessing it. 

8 So, Mr. Harvey, are you -- is Mr. Harvey in charge of 


9 giving you instructions or -- I gather? Are his folks out in 





10 the field at all, or is it -- I'm not -- or is it your folks 





11 who are doing the L&éA testing? I mean Mr. Barnes. 





12 I mean, it is somebody from the county. But who is 

13 the technical adviser, if there is anyone? 

14 MR. BARNES: Logic and accuracy testing is a county 

1D responsibility. So it is in the hands of the county. 

16 THE COURT: And do they -- are they relying then on 

17 that 2000 -- January 2020 procedures manual in determining how 


18 to proceed? 





19 MR. BARNES: To my understanding, yes, Your Honor. 

20 THE COURT: And this is not something that you have 
21 given directions to anyone about in the field, I gather? 

22 MR. BARNES: That would be correct. 

23 THE COURT: And do you have any idea whatsoever why 
24 there was an impression that it was a database that is going to 


25 be distributed rather than software in the communication? 
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1 MR. BARNES: Your Honor, I do not know why they chose 








2 the word database for distribution. It was always that 





3 application install -- an application upgrade installation. 





4 MR. MILLER: Your Honor, I believe we can speak to a 





5 little bit of clarity on that in that the form that you saw 








6 attached to the email that, I believe, Mr. Brown filed is a 


7 standard form that is used when databases are delivered to say, 





8 here is the schedule, here is where we're coming through. 





9 And so that form didn't change because it was the 





10 same type of run. So it is the same type of thing that the 


11 counties are used to doing and that the investigators and 





12 liaisons sent out. And, you know, frankly, I think it may have 


13 been a bit of a misunderstanding amongst the county liaisons 





14 who were the direct contact as to what was being delivered but 
15 they knew something was being delivered on this schedule. 


16 THE COURT: I would like to just take a short break 








17 so I can talk to Ms. Cole privately, and then -- then we'll 


18 resume. 





19 . RUSSO: Your Honor, could we let Mr. Barnes go 








21 THE COURT: Let him stay for just a minute. 
22 keep him much more. Thank you. 
23 (A brief break was taken at 11:00 A.M.) 


24 COURT: Mr. Brown, Mr. Miller? Let me just say 





25 to counsel and I realize this is not Mr. Barnes' direct 
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responsibility. But he also described the process as he 


envisioned it at least and testified. So that has some value. 





At the very least -- and I would say perhaps more 
than that -- the procedure that was identified on the January 
memo is susceptible to a very different interpretation or 
multiple interpretations. 


And given the importance of the software -- the Lé&A 








testing, I can't tell you that you are mandated, but I think 


you would be really behooved -- it would strongly behoove the 





State in the interest of everyone involved here that there be 


clarification of what the process is. 








You are using -- even though it has been identified 
as a de minimis change, even if it hadn't been a change, it 
would have been important for there to be -- in this first use 
statewide in a major election to have this strong L&A testing. 


And even if it is construed the way Mr. Barnes says 


with the effect of it after you get to position four you are 


going to have fewer tests, you will still have a lot of tests. 
But, you know, it would have been -- it would be a better thing 


to have a different process for dealing with this wrinkle. 





But even so, I don't think that -- from what the 
evidence was in the record that it is -- that the L&A testing 
is being pursued in the way that -- the more pristine manner 
described by Mr. Barnes. And maybe it is in some places, but 


in many places it is not. 
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So, you know, to the extent that, you know, it is 


still in process, which it definitely is -- it is just 





beginning -- I would really encourage the State to think about 





providing clearer directions, you know, thinking about 
having -- not just relying on a written one but having some 


sort of video conference to discuss it. And maybe you-all feel 





like it is not necessary and that is -- but I think the 
evidence might point to the contrary and -- 


MR. MILLER: Your Honor, I would want to say that, 








you know, the memorandum that Mr. Barnes drafted that was 
distributed by the elections director, that is not in a vacuum. 
They conduct monthly webinars. They send various instructions 
through Firefly. And those kind of things just haven't come 
into evidence in this case because it, frankly, wasn't at that 
point as much of a disputed issue. 

We, frankly, thought we were talking about malware on 
ballot-marking devices. But suffice it to say, Your Honor, 


that there is a significant amount of additional kind of 


guidance and instructive material to the county superintendents 


throughout the election process through webinars and things of 
that nature. 
THE COURT: Well -- 


MR. MILLER: And it touches on this and other issues. 





And, again, I could go into things that, frankly, are 


definitely not an issue in this case as to candidate 
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qualification challenges, things of that nature. 


THE COURT: I think that this case deals with a 





variety of things that relate to the machine translating the 


vote cast by the citizen that walks into the booth or cast in a 








different way. So I'm just -- that is -- I'm just making these 


comments. 








I encourage you because of the way the evidence came 








in and what it shows. I'm not saying -- I'm not in any way 
obviously in a position to say that you -- Mr. Miller, that the 


individual messages haven't gone out. 





But the -- I still have the testimony in front of me. 





[ have the January procedures, which are the official 








procedures from the Secretary of State about doing this -- 








preparing for an election that were in front of me. And then 





have voters as well as others who were on the board -- on the 





boards' affidavits. So that is what I'm relying on in just 
mentioning it to you. But, you know -- 


MR. MILLER: I understand, Your Honor. 











trying to add additional evidence now. 


THE COURT: I'm talking about the long run here. 





interest is not -- you know, even though it is described as 





interfering, my interest is in seeing that the voting system 





works and the voters' votes are counted and that there are no 
screwups on elections that end up having you back in court. 


That is -- and to deal with the case in front of me and to deal 
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with it in an honest and straightforward way. 








And I wouldn't be having this conference otherwise so 





can really understand what is going on. And -- 


MR. MILLER: We understand. 





THE COURT: So this is a change. So that is what 





dealing with. 





still would -- as soon as you do have the -- 








whatever the submission is from Pro V&V, I would like it to be 
submitted on the record so that we have it. And the same 
thing -- and what the submission is to the EAC. 


And if there is any further clarification that is 








provided on L&A testing, I would like to be notified of that. 











Because right now I have -- I mean, this is exactly what I'm 





dealing with. I have to issue an order, and I don't want my 





order to be inaccurate in any respect factually. 





You may contest the conclusions. But I don't want it 





to be inaccurate. And we have all worked really long enough to 
know that is a concern always. 
All right. Now -- 


MR. MILLER: Yes, Your Honor. I apologize. And I do 








just to -- as we started off today, I do just want to reiterate 





— 


that we are appreciative of that and your attention to this. 


And, frankly, the Secretary has the same goal of ensuring that 





the election can go forward in the most efficient and effective 


manner. 
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He And, Your Honor, we are appreciative and will remain 
2 responsive to the Court's requests. But it is truly a -- you 


3 know, we are at crunch time. And our local election officials 





4 are trying to administer elections while they are performing 





c= 


5 inspections for the Coalition plaintiffs. Our State election 


6 officials are trying to help out. And in practical 








7 realities -- and I understand the Court did not intend -- and 
8 we did not intend to have a negative tone towards the Court. 
9 THE COURT: All right. We'll look at -- when 


10 Ms. Welch gets her transcript out, I'll determine if there are 





11 any -- what portions of the video could be made available on 


12 the public docket. 





13 I don't want to get myself in another problem with 
14 not having a hearing being in public that should be. And 


15 that's really again -- and there might be nothing here that is 





16 confidential. 
17 But you are welcome to send me, just having 


18 participated in this, any of your position about this and about 





19 what portion should be in the public or if all of it can be in 





20 the public. 
21 If you are going to do that, just simply so I can 


22 proceed on a timely basis, I would appreciate your letting me 





23 know -- let's see. It is 11:00 today. If you could let us 
24 know by 4:00. 


25 MR. RUSSO: Your Honor, are we going to get a copy -- 
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1 how do we go about doing that? Do we get a copy of the video? 











2 I mean, I do think probably Dr. Coomer's testimony is 


3 something that may not need to be public. However, I just want 








4 to make sure we understand the process here. We review the 
ie video and send something to you or just -- 


6 THE COURT: Well, I think at this point I'm not sure 




















7 we're going to be able to -- I have to find out from IT. f we 








8 have the video, we'll give it to you. And if not, you're going 





9 to have to just simply go by your recollection -- your joint 


10 recollection -- 





11 MR. RUSSO: Okay. 
12 THE COURT: -- of counsel there. 


13 MR. RUSSO: You say by 4:00 today? 





14 THE COURT: By 4:00. But I'll let you -- we'll let 
15 you know right away whether we can get you a video. 


16 MR. RUSSO: Okay. I didn't know how that -- 








17 never had a recording. 


18 THE COURT: It is either yes or no that we can do it. 





19 All right. 
20 MR. CROSS: Your Honor, could I ask just -- because 


21 it 1s something that may be breaking, we have heard a lot of 





22 new information today. Could we just have Dr. Halderman just 





23 briefly respond to a couple of points? Because it sounds like 


24 this is stuff you are considering for Your Honor's order. 





25 THE COURT: All right. But I would like to release 
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objection. 


MR. CROSS: 


MR. BROWN: 


THE COURT: 


can go on with life. 


because I 


MR. BARNES: 


THE COURT: 


Go ahead. 


MR. MILLER: 
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that he can go back to work, unless you have an 


No. 
No objection. 


All right. Mr. Barnes, you are -- you 


Thank you, Your Honor. 


All right. Thank you very much. 





Your Honor, before Dr. Halderman begins, 





don't want to interrupt, we just do want to state our 


objection on the record to the continued expansion of the 


evidence at issue. 


has something useful 





said, 








give you just 


THE COURT: 





MR. RUSSO: 


THE COURT: 


Well, I think that to the extent that he 





1 that helps me understand what has been 


I think the plaintiffs have an opportunity to -- 





It may be -- you know, to the extent that 





Dr. Coomer needs to listen to this -- and I don't know -- 


You can show -- you are welcome to try to 


Coomer. But it seemed like he had a conflict. 


MR. RUSSO: 


COURT: 


MR. RUSSO: 


THE COURT: 


I guess I could show him the video maybe. 
Or you could get Ms. Welch -- 
And he could respond to any -- 


You could see if you could get her to 


his portion of the testimony. 
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MR. RUSSO: Okay. I just want to 


respond since there was a disputed issue 


two. 


THE COURT: Ms. Welch, 


produce Mr. Halderman's -- we don't know 


let's say it is 20 minutes. 


that around fairly quickly? 


COURT REPORTER: 


quickly, Judge. Whatever they ask of me, 





are 


I can turn it al 


66 





make sure we get to 


earlier between the 





you able just to -- just 





how long it is. But 


Are you able to do that -- turn 


ll around very 


I do. 


(There was a brief pause in the proceedings. ) 


THE COURT: 


or the other. Very good. 





All right. 


We'll get it to you one way 


Can we unmute Dr. Halderman? 


DR. HAL 








DERMAN: 


COURT: Yes. 


Mr. Cross, 


him some questions? 


MR. CROSS: Yeah. 


listening. 





Hello. 


Can you hear me, Your Honor? 








Probably the easiest way is: Dr. 


did you want to structure this and give 


I think he's been 


Halderman, it 


sounds like there are a few points that you had to respond to. 





Go ahead. 


DR. HAL 








DERMAN: Yes, 


of course. 


helpful to the Court in this manner. 


First, just to respond to the point that 
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made about my suggestion in my most recent affidavit that 








procedural remedies could cure this problem, I think his 





response seems to indicate that the problem that we're 
attempting to or the State is attempting to fix here is a 


complex one, that it is possible to reproduce it but 





reproducing it reliably, he testified, requires operating with 
a simpler version of the ballot. 


And that just gives me further concern about whether 








the software fix can be adequately tested given the time that 


is available. 





Now, beyond that, I would like to reiterate the 








substance of the security concerns that I have. We have to be 





clear that even if the change to the source code is a small 





one, as Dominion says it is, the process of updating this 





software requires replacing completely the core of the Dominion 














software on every BMD. 
We know that because the update instructions are to 


uninstall the APK, that is, the package that contains almost 





all of the Dominion software that runs on the ballot-marking 
device, and install a new APK, a new copy of all of that 
software. 


P 3 


So this is, frankly, quite alarming from a security 





perspective. Replacing the BMD software at this juncture so 





P=% 


close to the election is an ideal opportunity for attackers who 





might want to infiltrate the machines. 
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If attackers have gained access to Dominion's 
systems, to Pro V&éV's systems, to the CES systems, or to the 
county systems that are going to be creating and distributing 
this software change, that would be an opportunity for the 


attackers to subvert the software that runs on election day. 





And, frankly, none of the procedures I have heard described 
here today would be adequate to stop that. 
So beyond the security questions, the change at this 


point seriously concerns me from an accuracy and correctness 





standpoint. As I said, the software change is fixing a problem 
that is complex to reproduce. It is difficult to test to 


ensure that the fix actually does correct that problem and 





that -- and it is virtually impossible at this last minute to 





thoroughly test that it doesn't create new problems. 


So quite often last-minute changes to complex systems 


do create other unknown consequences. And while the previous 





version of the BMD software at least had been tested through 





use in elections, as Dr. Coomer testified millions of voters in 
aggregate, this new software has only existed for a matter of 
days. 

I myself personally have spent more time testing the 


old version of the software than anyone has spent testing the 

















new version of the software because it has only existed for 





such a short time. 


Pro V&éV hasn't even had an opportunity to write up 
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its findings. Those finding have not been reviewed by EAC, 
which has introduced this de minimis testing categorization for 
emergency fixes in small -- that are small in nature. But the 


State isn't even following that -- that special case process 





that has been put in place by EAC. It seems that that process 
itself is being circumvented. It just seems quite extreme 
in -- under these circumstances to forgo even that level of 


compliance. 





I wanted to just briefly address the L&A procedures 





that we heard described. I think two key points about that are 


that the L&A testing we have heard about would be trivial for 





malware to detect and bypass. It has a very clear signature 





that the BMD can see, that ballots are being printed, that are 


being marked in the same position across every race. 





It would be absolutely simple if you were programming 





malware for the BMDs to have it avoid cheating on ballots that 
are marked in the same position across each race. 

So the security value of this L&A testing is minimal. 
And we have also heard -- and I think this point came out 


clearly for the first time today -- that the L&A testing isn't 





even checking to make sure that each BMD correctly produces a 


ballot for each -- for the entire set of candidates in every 





race. 
You don't have to test necessarily every permutation 


of candidates in order to check that. But the least that 
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would expect from an L&A procedure would be that it checks that 








each BMD can correctly mark a ballot for each candidate. 


And as we have heard today, because of the length of 








the Senate race, many BMDs apparently will not even be tested 








to make sure that they can print a ballot that is marked for 


each candidate in the presidential race. And that concerns me 





because a particular BMD might have a corrupted somehow copy of 





the database -- of the programming that goes into it. 





And the L&éA procedures, as described, because they 





don't involve printing a ballot from each BMD that has been 


marked for every candidate, wouldn't be able to pick up that 





problem. You have to actually test that each candidate has 





been marked and can be tabulated correctly. 


THE COURT: Wait a second. 








DR. HALDERMAN: Apparently someone is sawing on the 





outside of my building, and I may have to quickly move to 
another room. 


But I think I have addressed the points that 














mind. But I'm very happy to answer any questions. 





MR. CROSS: Dr. Halderman, just a couple of follow-up 
questions. And the Court may have questions or Mr. Russo. 
In your experience looking at elections over the 


years, is there any election that comes to mind where a state 


was replacing the software with new software less than two 


weeks before the -- 
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DR. HALDERMAN: No, nothing comes to mind. This 











is -- this is not a typical procedure to be going through. 
an emergency, perhaps you would need to. But even then, it 


would be an extremely risky thing to be doing both from a 





correctness standpoint and from a security standpoint. 


MR. CROSS: And just two final questions. Are there 





real world examples you have seen where a software change that 





even had been fully vetted and was intended to fix one discrete 
problem that that then had unintended consequences that were 
quite significant? 


DR. HALDERMAN: Well, the most significant recent 








example, of course, is the 737 MAX aircraft where after most of 





the testing had been completed Boeing introduced what they 


believed was a relatively small design change to the control 





system that they didn't believe needed to be rigorously tested 


because it was the equivalent of de minimis. 








But that unfortunately reportedly had fatal 


consequences and has been tied to crashes that have killed 





several hundred people. But I think that is an illustration. 


I think it is a good parallel because both the Georgia election 





system and the aircraft are examples of complex software 
systems. 


Georgia's election system is millions of lines of 








source code that are in the Dominion products. And for that 


reason, small, even seemingly trivial changes can have 
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It is just -- it is why we normally in the voting 


system testing and certification process demand such extended 


testing for accuracy 


rule out security problems. 


That kind of testing can't necessarily 


But it does a lot to help ensure 


that votes are going to be counted correctly in the absence of 


an attacker. 


And it is those processes that are being bypassed 


here and substituted with apparently less than a week of -- of 


very rapid-fire testing of some sort. 


Nothing like the testing 


that goes into a voting system in the course of a normal 


software change. 


MR. CROSS: 


mentioned that the LAT, 





Last question, Dr. Halderman. 


You 


the logic and accuracy testing -- 


(There was a brief pause in the proceedings. ) 


MR. CROSS: 





clear signature of testing under this Lé&éA process. 





Dr. Halderman, you said that there is a 


For 


example, the candidates are selected in the same position. 








THE COURT: 


background? 


DR. HALDERMAN: Yes. 








Does anyone have somebody speaking in the 


(There was a brief pause in the proceedings. ) 


MR. CROSS: 


better? 





It seems like it got quieter. 


Okay. Let me try it again. 


UNI 
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Dr. Halderman, the question was: You said that there 
is a clear signature for the machine to see that it is being 
tested during the logic and accuracy testing. One example, of 
course, is all the candidates are in the same position; right? 
They are all selected in Position 3. 

Just to show the Court this is not a hypothetical 
concern, that the malware can trick the machine during testing, 


is there a real world example of where that has happened? 








DR. HALDERMAN: Of where malware would -- of malware 











detecting such a thing? 


MR. CROSS: Yes. Testing and then -- 





DR. HALDERMAN: Detecting testing. Well, of course, 











the prominent example of that is the BMW -- excuse me -- the 





lkswagen emissions testing scandal, Dieselgate scandal, where 





lkswagen programmed its emission systems to detect -- they 


were going through EPA testing and emit less pollutants under 


those circumstances. 
So the parallel here is detect that the ballot 


been marked in the same position across all races and in 





case don't cheat; otherwise, cheat with some probability. 





would be -- for malware running on a BMD, that would be 
absolutely a simple thing to program. 

MR. CROSS: Thank you, Your Honor. 

THE COURT: Let me just make sure I understand from 


your perspective what this meant in terms of the testing 
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that -- in terms of the printing of ballots. Any time -- any 





ballots -- let's say that there were -- because we were using 


the example previously of four, that there would not be ballots 





printed with -- that would reflect any other ballot choices as 


c= 


you -- as they -- for any of the -- any of the times where 








people had cast ballots for candidates five and onward. 


DR. HALDERMAN: Yes, Your Honor. My understanding of 











the testimony we heard today is that one BMD would be used to 
print a ballot marked in the first position across every race, 
another the second position, another the third position, et 


cetera and that races that had fewer than that number of 





positions the race would just be left blank on the BMD that was 


being tested. 





So each BMD produces one printout that is marked in 


one equivalent position across every race. And that, of 





course, has the problem that for a given BMD most of the 


possible positions that could be marked are not going to be 


exercised all the way through being printed and being 


tabulated. 





So if a particular BMD has a database that is somehow 





corrupted and programmed differently from the other BMDs under 





testing, the problem would not be discovered. 
THE COURT: All right. Anything else, Counsel? 


MR. CROSS: Not for us, Your Honor. This is David 











If they want to ask questions, they are welcome to. 
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MR. RUSSO: Your Honor, I don't think we have any 





questions. 


THE COURT: All right. Well, thank you-all very 





MR. CROSS: Your Honor, I'm sorry. There was one 


final thing that we wanted to clear up if we could. Mr. Brown 





sent an email in this morning. I don't know if you saw it. 

THE COURT: No, I did not. 

MR. CROSS: We're just trying to confirm -- Mr. Tyson 
sent in an email indicating that there was a message that went 


out from Mr. Harvey clarifying that there were no new databases 





coming out as opposed to a software change. He indicated that 
message went to the counties on Tuesday. The copies that we 
have -- we have multiple copies from the counties -- indicated 


it went yesterday around the same time of Mr. Tyson's email. 





Vincent or Carey, do you know when that actually went 
out to the counties? 


MR. RUSSO: I mean, I believe that it is -- so we 








looked at it earlier -- what Bruce sent. Buzz is a webface. 
It is a web portal. So I think Mr. Harvey posted it on Buzz in 
accordance with what Mr. Tyson represented. And the email went 


out the following day due to however Buzz, the program, 


populates the email that automatically goes out. 


MR. CROSS: Okay. Thank you. 


That is all, Your Honor. Thank you. 
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1 THE COURT: All right. Thank you very much. And 








2 we'll be -- we'll be in touch. I mean, I'm trying to get an 








3 order out this week. So I appreciate everyone scurrying to get 
4 this in front of me. 

3) MR. CROSS: Thank you, Your Honor. 

6 MR. RUSSO: Thank you, Your Honor. 

7 (The proceedings were thereby concluded at 


8 11:32 A.M.) 
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